# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 02.01.2020 10:12:03.978 Process: id = "1" image_name = "cusersadministratorappdatalocal5.10.2019taskmgr.exe" filename = "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe" page_root = "0x34bbc000" os_pid = "0xe94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x6e4 [0076.231] GetProcessHeap () returned 0xe70000 [0076.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x30) returned 0xe82f58 [0076.231] GetProcessHeap () returned 0xe70000 [0076.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x3330) returned 0xe8f758 [0076.245] GetProcessHeap () returned 0xe70000 [0076.245] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x204) returned 0xe8d080 [0076.246] GetProcessHeap () returned 0xe70000 [0076.246] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe8e260 [0076.247] GetTickCount () returned 0x1153499 [0076.248] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd7fa40 | out: lpWSAData=0xd7fa40) returned 0 [0076.258] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xd7fa20, cchData=32 | out: lpLCData="\x03") returned 16 [0076.260] GetProcessHeap () returned 0xe70000 [0076.260] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1c) returned 0xe7b100 [0076.260] GetProcessHeap () returned 0xe70000 [0076.260] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1c) returned 0xe7adb8 [0076.260] GetVersion () returned 0x23f00206 [0076.260] GetCurrentProcess () returned 0xffffffff [0076.260] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xd7f994 | out: TokenHandle=0xd7f994*=0x20c) returned 1 [0076.260] GetTokenInformation (in: TokenHandle=0x20c, TokenInformationClass=0x14, TokenInformation=0xd7f98c, TokenInformationLength=0x4, ReturnLength=0xd7f990 | out: TokenInformation=0xd7f98c, ReturnLength=0xd7f990) returned 1 [0076.260] CloseHandle (hObject=0x20c) returned 1 [0076.261] GetProcessHeap () returned 0xe70000 [0076.261] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe7af98 [0076.261] GetProcessHeap () returned 0xe70000 [0076.261] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe97050 [0076.261] GetProcessHeap () returned 0xe70000 [0076.261] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe96fb0 [0076.261] GetProcessHeap () returned 0xe70000 [0076.261] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0076.261] GetProcessHeap () returned 0xe70000 [0076.261] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0076.262] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe97050, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0076.262] GetProcessHeap () returned 0xe70000 [0076.262] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96fb0 | out: hHeap=0xe70000) returned 1 [0076.262] GetProcessHeap () returned 0xe70000 [0076.262] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7af98 | out: hHeap=0xe70000) returned 1 [0076.262] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd7f934, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd7f934*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.263] GetProcessHeap () returned 0xe70000 [0076.263] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97050 | out: hHeap=0xe70000) returned 1 [0076.263] GetProcessHeap () returned 0xe70000 [0076.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe828f0 [0076.263] GetProcessHeap () returned 0xe70000 [0076.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82aa0 [0076.263] GetProcessHeap () returned 0xe70000 [0076.263] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82aa0, Size=0x72) returned 0xe7e4c8 [0076.263] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0076.264] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x20c [0076.264] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x0 [0076.264] GetProcessHeap () returned 0xe70000 [0076.264] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe828f0 | out: hHeap=0xe70000) returned 1 [0076.264] GetProcessHeap () returned 0xe70000 [0076.264] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7e4c8 | out: hHeap=0xe70000) returned 1 [0076.264] GetProcessHeap () returned 0xe70000 [0076.265] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe7af98 [0076.265] GetProcessHeap () returned 0xe70000 [0076.265] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe973e8 [0076.265] GetProcessHeap () returned 0xe70000 [0076.265] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe97410 [0076.265] GetProcessHeap () returned 0xe70000 [0076.265] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0076.265] GetProcessHeap () returned 0xe70000 [0076.265] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0076.266] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe973e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0076.266] GetProcessHeap () returned 0xe70000 [0076.266] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97410 | out: hHeap=0xe70000) returned 1 [0076.266] GetProcessHeap () returned 0xe70000 [0076.266] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7af98 | out: hHeap=0xe70000) returned 1 [0076.266] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.266] GetProcessHeap () returned 0xe70000 [0076.266] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe973e8 | out: hHeap=0xe70000) returned 1 [0076.266] GetProcessHeap () returned 0xe70000 [0076.266] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe824b8 [0076.266] GetProcessHeap () returned 0xe70000 [0076.266] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82590 [0076.267] GetProcessHeap () returned 0xe70000 [0076.267] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82590, Size=0x72) returned 0xe971c8 [0076.267] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0076.267] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x210 [0076.267] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x0 [0076.267] GetProcessHeap () returned 0xe70000 [0076.267] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe824b8 | out: hHeap=0xe70000) returned 1 [0076.267] GetProcessHeap () returned 0xe70000 [0076.267] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe971c8 | out: hHeap=0xe70000) returned 1 [0076.267] ReleaseMutex (hMutex=0x210) returned 1 [0076.268] CloseHandle (hObject=0x210) returned 1 [0076.268] GetProcessHeap () returned 0xe70000 [0076.268] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x30) returned 0xe83508 [0076.268] GetProcessHeap () returned 0xe70000 [0076.268] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe975a8 [0076.268] GetVersion () returned 0x23f00206 [0076.268] GetProcessHeap () returned 0xe70000 [0076.268] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe7e4c8 [0076.268] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0076.268] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0076.268] Wow64DisableWow64FsRedirection (in: OldValue=0xd7f970 | out: OldValue=0xd7f970*=0x0) returned 1 [0076.268] GetProcessHeap () returned 0xe70000 [0076.268] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7e4c8 | out: hHeap=0xe70000) returned 1 [0076.269] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0076.269] GetProcAddress (hModule=0x761b0000, lpProcName="CreateProcessWithTokenW") returned 0x761c0c70 [0076.269] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe975a8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0076.269] GetShellWindow () returned 0x100f0 [0076.270] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0xd7f97c | out: lpdwProcessId=0xd7f97c) returned 0x864 [0076.270] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x860) returned 0x210 [0076.270] OpenProcessToken (in: ProcessHandle=0x210, DesiredAccess=0x2000000, TokenHandle=0xd7f98c | out: TokenHandle=0xd7f98c*=0x214) returned 1 [0076.271] DuplicateTokenEx (in: hExistingToken=0x214, dwDesiredAccess=0x2000000, lpTokenAttributes=0xd7f954, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xd7f990 | out: phNewToken=0xd7f990*=0x218) returned 1 [0076.271] CreateProcessWithTokenW (in: hToken=0x218, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xd7f908*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xd7f960 | out: lpCommandLine=0x0, lpProcessInformation=0xd7f960*(hProcess=0x254, hThread=0x258, dwProcessId=0x4ac, dwThreadId=0xdc0)) returned 1 [0076.882] GetProcessHeap () returned 0xe70000 [0076.882] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe991b0 [0076.882] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0076.883] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75ea6b50 [0076.883] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0076.883] GetProcessHeap () returned 0xe70000 [0076.883] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe991b0 | out: hHeap=0xe70000) returned 1 [0076.883] CloseHandle (hObject=0x210) returned 1 [0076.884] CloseHandle (hObject=0x254) returned 1 [0076.884] CloseHandle (hObject=0x258) returned 1 [0076.884] CloseHandle (hObject=0x214) returned 1 [0076.884] CloseHandle (hObject=0x218) returned 1 [0076.884] GetProcessHeap () returned 0xe70000 [0076.884] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe975a8 | out: hHeap=0xe70000) returned 1 [0076.884] GetProcessHeap () returned 0xe70000 [0076.884] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe83508 | out: hHeap=0xe70000) returned 1 [0076.884] Sleep (dwMilliseconds=0x1388) [0082.236] GetProcessHeap () returned 0xe70000 [0082.236] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x60) returned 0xe8e6c8 [0082.237] GetProcessHeap () returned 0xe70000 [0082.237] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x5c) returned 0xe76800 [0082.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd3c1a, lpParameter=0xe76800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0082.240] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x1388) returned 0x102 [0088.228] CloseHandle (hObject=0x218) returned 1 [0088.228] GetProcessHeap () returned 0xe70000 [0088.228] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe8e6c8 | out: hHeap=0xe70000) returned 1 [0088.228] GetProcessHeap () returned 0xe70000 [0088.228] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x60) returned 0xe8e6c8 [0088.228] GetProcessHeap () returned 0xe70000 [0088.228] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe981d0 [0088.228] GetProcessHeap () returned 0xe70000 [0088.228] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe984a0 [0088.228] GetProcessHeap () returned 0xe70000 [0088.228] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98180 [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.229] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xe984a0, nSize=0xf | out: lpDst="") returned 0x1e [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98180 | out: hHeap=0xe70000) returned 1 [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe984a0, Size=0x3a) returned 0xe823e0 [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x3a) returned 0xe828f0 [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.229] GetProcessHeap () returned 0xe70000 [0088.229] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.229] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xe823e0, nSize=0x1d | out: lpDst="") returned 0x1e [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe828f0 | out: hHeap=0xe70000) returned 1 [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe823e0, Size=0x72) returned 0xe973c8 [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x72) returned 0xe96fc8 [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.230] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xe973c8, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96fc8 | out: hHeap=0xe70000) returned 1 [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981d0 | out: hHeap=0xe70000) returned 1 [0088.230] GetProcessHeap () returned 0xe70000 [0088.230] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82428 [0088.230] GetProcessHeap () returned 0xe70000 [0088.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3e) returned 0xe82818 [0088.231] GetProcessHeap () returned 0xe70000 [0088.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x3e) returned 0xe828f0 [0088.231] GetProcessHeap () returned 0xe70000 [0088.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.231] GetProcessHeap () returned 0xe70000 [0088.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe97e00 [0088.231] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f874 | out: phkResult=0xd7f874*=0x26c) returned 0x0 [0088.232] RegQueryValueExW (in: hKey=0x26c, lpValueName="Startup", lpReserved=0x0, lpType=0xd7f870, lpData=0xe828f0, lpcbData=0xd7f878*=0x3e | out: lpType=0xd7f870*=0x2, lpData=0xe828f0*=0x25, lpcbData=0xd7f878*=0x98) returned 0xea [0088.232] RegCloseKey (hKey=0x26c) returned 0x0 [0088.232] GetProcessHeap () returned 0xe70000 [0088.232] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97e00 | out: hHeap=0xe70000) returned 1 [0088.232] GetProcessHeap () returned 0xe70000 [0088.232] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.232] GetProcessHeap () returned 0xe70000 [0088.232] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe828f0 | out: hHeap=0xe70000) returned 1 [0088.232] GetProcessHeap () returned 0xe70000 [0088.232] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82818, Size=0x7a) returned 0xe81e08 [0088.232] GetProcessHeap () returned 0xe70000 [0088.232] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x7a) returned 0xe81fc0 [0088.232] GetProcessHeap () returned 0xe70000 [0088.232] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7e988 [0088.233] GetProcessHeap () returned 0xe70000 [0088.233] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe97c68 [0088.233] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f874 | out: phkResult=0xd7f874*=0x26c) returned 0x0 [0088.233] RegQueryValueExW (in: hKey=0x26c, lpValueName="Startup", lpReserved=0x0, lpType=0xd7f870, lpData=0xe81fc0, lpcbData=0xd7f878*=0x7a | out: lpType=0xd7f870*=0x2, lpData=0xe81fc0*=0x88, lpcbData=0xd7f878*=0x98) returned 0xea [0088.233] RegCloseKey (hKey=0x26c) returned 0x0 [0088.233] GetProcessHeap () returned 0xe70000 [0088.233] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c68 | out: hHeap=0xe70000) returned 1 [0088.233] GetProcessHeap () returned 0xe70000 [0088.233] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7e988 | out: hHeap=0xe70000) returned 1 [0088.233] GetProcessHeap () returned 0xe70000 [0088.233] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0088.233] GetProcessHeap () returned 0xe70000 [0088.233] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81e08, Size=0xf2) returned 0xe81260 [0088.233] GetProcessHeap () returned 0xe70000 [0088.233] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xf2) returned 0xe800f0 [0088.234] GetProcessHeap () returned 0xe70000 [0088.234] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.234] GetProcessHeap () returned 0xe70000 [0088.234] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe97e00 [0088.234] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f874 | out: phkResult=0xd7f874*=0x26c) returned 0x0 [0088.234] RegQueryValueExW (in: hKey=0x26c, lpValueName="Startup", lpReserved=0x0, lpType=0xd7f870, lpData=0xe800f0, lpcbData=0xd7f878*=0xf2 | out: lpType=0xd7f870*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xd7f878*=0x98) returned 0x0 [0088.234] RegCloseKey (hKey=0x26c) returned 0x0 [0088.234] GetProcessHeap () returned 0xe70000 [0088.234] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97e00 | out: hHeap=0xe70000) returned 1 [0088.234] GetProcessHeap () returned 0xe70000 [0088.234] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe984a0 [0088.234] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f874 | out: phkResult=0xd7f874*=0x26c) returned 0x0 [0088.235] RegQueryValueExW (in: hKey=0x26c, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd7f870, lpData=0xe80188, lpcbData=0xd7f878*=0x5a | out: lpType=0xd7f870*=0x0, lpData=0xe80188*=0x1a, lpcbData=0xd7f878*=0x5a) returned 0x2 [0088.235] RegCloseKey (hKey=0x26c) returned 0x0 [0088.235] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f888 | out: phkResult=0xd7f888*=0x26c) returned 0x0 [0088.235] RegQueryValueExW (in: hKey=0x26c, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd7f884, lpData=0xe80188, lpcbData=0xd7f88c*=0x5a | out: lpType=0xd7f884*=0x2, lpData=0xe80188*=0x1a, lpcbData=0xd7f88c*=0x78) returned 0xea [0088.235] RegCloseKey (hKey=0x26c) returned 0x0 [0088.235] GetProcessHeap () returned 0xe70000 [0088.235] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0088.235] GetProcessHeap () returned 0xe70000 [0088.235] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.236] GetProcessHeap () returned 0xe70000 [0088.236] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe800f0 | out: hHeap=0xe70000) returned 1 [0088.236] GetProcessHeap () returned 0xe70000 [0088.236] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81260, Size=0x1e2) returned 0xe977b8 [0088.236] GetProcessHeap () returned 0xe70000 [0088.236] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e2) returned 0xe987f0 [0088.236] GetProcessHeap () returned 0xe70000 [0088.236] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.236] GetProcessHeap () returned 0xe70000 [0088.236] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe97ce0 [0088.236] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f874 | out: phkResult=0xd7f874*=0x26c) returned 0x0 [0088.236] RegQueryValueExW (in: hKey=0x26c, lpValueName="Startup", lpReserved=0x0, lpType=0xd7f870, lpData=0xe987f0, lpcbData=0xd7f878*=0x1e2 | out: lpType=0xd7f870*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xd7f878*=0x98) returned 0x0 [0088.236] RegCloseKey (hKey=0x26c) returned 0x0 [0088.236] GetProcessHeap () returned 0xe70000 [0088.236] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97ce0 | out: hHeap=0xe70000) returned 1 [0088.237] GetProcessHeap () returned 0xe70000 [0088.237] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe980b8 [0088.237] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f874 | out: phkResult=0xd7f874*=0x26c) returned 0x0 [0088.237] RegQueryValueExW (in: hKey=0x26c, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd7f870, lpData=0xe98888, lpcbData=0xd7f878*=0x14a | out: lpType=0xd7f870*=0x0, lpData=0xe98888*=0x0, lpcbData=0xd7f878*=0x14a) returned 0x2 [0088.237] RegCloseKey (hKey=0x26c) returned 0x0 [0088.237] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xd7f888 | out: phkResult=0xd7f888*=0x26c) returned 0x0 [0088.237] RegQueryValueExW (in: hKey=0x26c, lpValueName="Common Startup", lpReserved=0x0, lpType=0xd7f884, lpData=0xe98888, lpcbData=0xd7f88c*=0x14a | out: lpType=0xd7f884*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xd7f88c*=0x78) returned 0x0 [0088.237] RegCloseKey (hKey=0x26c) returned 0x0 [0088.237] GetProcessHeap () returned 0xe70000 [0088.237] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe980b8 | out: hHeap=0xe70000) returned 1 [0088.237] GetProcessHeap () returned 0xe70000 [0088.237] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.238] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xe977b8, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe987f0 | out: hHeap=0xe70000) returned 1 [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82428 | out: hHeap=0xe70000) returned 1 [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe987f0 [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe98a08 [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe9c6b8 [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe9c8d0 [0088.238] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe987f0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0088.238] GetProcessHeap () returned 0xe70000 [0088.238] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe9cae8 [0088.238] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe9cae8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0088.239] GetProcessHeap () returned 0xe70000 [0088.239] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9cae8 | out: hHeap=0xe70000) returned 1 [0088.239] GetProcessHeap () returned 0xe70000 [0088.239] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe9cae8 [0088.239] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe9cae8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0088.239] GetProcessHeap () returned 0xe70000 [0088.239] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9cae8 | out: hHeap=0xe70000) returned 1 [0088.239] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), bFailIfExists=0) returned 1 [0088.402] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xd7f970 | out: phkResult=0xd7f970*=0x26c) returned 0x0 [0088.403] RegSetValueExW (in: hKey=0x26c, lpValueName="CUsersAdministratorAppDataLocal5.10.2019Taskmgr", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe", cbData=0xa2 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe") returned 0x0 [0088.404] RegCloseKey (hKey=0x26c) returned 0x0 [0088.404] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xd7f96c | out: phkResult=0xd7f96c*=0x26c) returned 0x0 [0088.404] RegSetValueExW (in: hKey=0x26c, lpValueName="CUsersAdministratorAppDataLocal5.10.2019Taskmgr", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe", cbData=0xa2 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe") returned 0x0 [0088.404] RegCloseKey (hKey=0x26c) returned 0x0 [0088.405] GetProcessHeap () returned 0xe70000 [0088.405] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x118) returned 0xe81760 [0088.405] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), bFailIfExists=1) returned 0 [0088.406] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), bFailIfExists=1) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81760 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe987f0 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98a08 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9c6b8 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9c8d0 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe8e6c8 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.424] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe973c8 | out: hHeap=0xe70000) returned 1 [0088.424] GetProcessHeap () returned 0xe70000 [0088.425] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe977b8 | out: hHeap=0xe70000) returned 1 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98338 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe981a8 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe981d0 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.425] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe981a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981d0 | out: hHeap=0xe70000) returned 1 [0088.425] GetProcessHeap () returned 0xe70000 [0088.425] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98338 | out: hHeap=0xe70000) returned 1 [0088.425] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd7f98c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd7f98c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.426] GetProcessHeap () returned 0xe70000 [0088.426] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0088.426] GetProcessHeap () returned 0xe70000 [0088.426] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe86ac8 [0088.426] GetProcessHeap () returned 0xe70000 [0088.426] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c98 [0088.426] GetProcessHeap () returned 0xe70000 [0088.426] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x60) returned 0xe8e6c8 [0088.426] GetProcessHeap () returned 0xe70000 [0088.426] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x5c) returned 0xe81e08 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81e08, Size=0xb6) returned 0xe81638 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97ce0 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x180) returned 0xe81760 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x250) returned 0xe987f0 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x84) returned 0xe81fc0 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x84) returned 0xe81500 [0088.427] GetProcessHeap () returned 0xe70000 [0088.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe813c0 [0088.427] GetProcessHeap () returned 0xe70000 [0088.428] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe813c0 | out: hHeap=0xe70000) returned 1 [0088.428] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xe81fc0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0088.428] GetProcessHeap () returned 0xe70000 [0088.428] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81500 | out: hHeap=0xe70000) returned 1 [0088.428] GetProcessHeap () returned 0xe70000 [0088.428] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.428] GetProcessHeap () returned 0xe70000 [0088.428] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xc0) returned 0xe81500 [0088.428] GetProcessHeap () returned 0xe70000 [0088.428] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xb8) returned 0xe813c0 [0088.428] GetProcessHeap () returned 0xe70000 [0088.428] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xb8) returned 0xe82cf8 [0088.428] GetProcessHeap () returned 0xe70000 [0088.428] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.429] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0xe813c0, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82cf8 | out: hHeap=0xe70000) returned 1 [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81500 | out: hHeap=0xe70000) returned 1 [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe977b8 [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe98a48 [0088.429] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe98a48, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98a48 | out: hHeap=0xe70000) returned 1 [0088.429] GetProcessHeap () returned 0xe70000 [0088.429] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x174) returned 0xe98a48 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe98a48, Size=0x3be) returned 0xe9c6b8 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x86) returned 0xe81e08 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81e08, Size=0xee) returned 0xe82cf8 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xba) returned 0xe81500 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe977b8 | out: hHeap=0xe70000) returned 1 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81760 | out: hHeap=0xe70000) returned 1 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe987f0 | out: hHeap=0xe70000) returned 1 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0088.430] GetProcessHeap () returned 0xe70000 [0088.430] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe813c0 | out: hHeap=0xe70000) returned 1 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c98 | out: hHeap=0xe70000) returned 1 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe8e6c8 | out: hHeap=0xe70000) returned 1 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98450 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe981a8 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98108 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.431] GetProcessHeap () returned 0xe70000 [0088.431] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.431] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe981a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.431] GetProcessHeap () returned 0xe70000 [0088.432] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98108 | out: hHeap=0xe70000) returned 1 [0088.432] GetProcessHeap () returned 0xe70000 [0088.432] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0088.432] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xd7f98c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xd7f98c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.432] GetProcessHeap () returned 0xe70000 [0088.432] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0088.432] GetProcessHeap () returned 0xe70000 [0088.432] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe86a38 [0088.432] GetProcessHeap () returned 0xe70000 [0088.432] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97da0 [0088.432] GetProcessHeap () returned 0xe70000 [0088.432] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x60) returned 0xe8e6c8 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x5c) returned 0xe81e08 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81e08, Size=0xb6) returned 0xe813c0 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97d88 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x180) returned 0xe81760 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x250) returned 0xe987f0 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x84) returned 0xe81fc0 [0088.433] GetProcessHeap () returned 0xe70000 [0088.433] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x84) returned 0xe7eb98 [0088.433] GetProcessHeap () returned 0xe70000 [0088.434] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81260 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81260 | out: hHeap=0xe70000) returned 1 [0088.434] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xe81fc0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7eb98 | out: hHeap=0xe70000) returned 1 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xc0) returned 0xe7eb98 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xb8) returned 0xe81260 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xb8) returned 0xe800f0 [0088.434] GetProcessHeap () returned 0xe70000 [0088.434] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.434] GetProcessHeap () returned 0xe70000 [0088.435] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.435] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0xe81260, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe800f0 | out: hHeap=0xe70000) returned 1 [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7eb98 | out: hHeap=0xe70000) returned 1 [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe977b8 [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe98a48 [0088.435] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe98a48, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98a48 | out: hHeap=0xe70000) returned 1 [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x174) returned 0xe98a48 [0088.435] GetProcessHeap () returned 0xe70000 [0088.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x24e) returned 0xe9ca80 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x86) returned 0xe81e08 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81e08, Size=0xee) returned 0xe7eb98 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xba) returned 0xe98bc8 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe977b8 | out: hHeap=0xe70000) returned 1 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81760 | out: hHeap=0xe70000) returned 1 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe987f0 | out: hHeap=0xe70000) returned 1 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0088.436] GetProcessHeap () returned 0xe70000 [0088.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81260 | out: hHeap=0xe70000) returned 1 [0088.436] GetProcessHeap () returned 0xe70000 [0088.437] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97da0 | out: hHeap=0xe70000) returned 1 [0088.437] GetProcessHeap () returned 0xe70000 [0088.437] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe8e6c8 | out: hHeap=0xe70000) returned 1 [0088.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd2013, lpParameter=0xd7f9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0088.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd1fab, lpParameter=0xd7f9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0088.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd1e4e, lpParameter=0xd7f9d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0088.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd1859, lpParameter=0xd7f9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0088.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd197c, lpParameter=0xd7f9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0088.620] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x6bc Thread: id = 10 os_tid = 0xb98 [0082.512] GetProcessHeap () returned 0xe70000 [0082.512] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98108 [0082.512] GetProcessHeap () returned 0xe70000 [0082.512] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe880a0 [0082.512] GetProcessHeap () returned 0xe70000 [0082.512] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x14) returned 0xe88080 [0082.512] GetProcessHeap () returned 0xe70000 [0082.512] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ff48 [0082.512] GetProcessHeap () returned 0xe70000 [0082.512] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ff48 | out: hHeap=0xe70000) returned 1 [0082.512] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xe880a0, nSize=0xa | out: lpDst="") returned 0x1c [0082.512] GetProcessHeap () returned 0xe70000 [0082.512] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe88080 | out: hHeap=0xe70000) returned 1 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe880a0, Size=0x26) returned 0xe86d98 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x26) returned 0xe86a08 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ff48 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ff48 | out: hHeap=0xe70000) returned 1 [0082.513] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xe86d98, nSize=0x13 | out: lpDst="") returned 0x1c [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe86a08 | out: hHeap=0xe70000) returned 1 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe86d98, Size=0x4a) returned 0xe990a8 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4a) returned 0xe99310 [0082.513] GetProcessHeap () returned 0xe70000 [0082.513] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ff48 [0082.513] GetProcessHeap () returned 0xe70000 [0082.514] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ff48 | out: hHeap=0xe70000) returned 1 [0082.514] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xe990a8, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0082.514] GetProcessHeap () returned 0xe70000 [0082.514] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe99310 | out: hHeap=0xe70000) returned 1 [0082.514] GetProcessHeap () returned 0xe70000 [0082.514] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98108 | out: hHeap=0xe70000) returned 1 [0082.514] GetProcessHeap () returned 0xe70000 [0082.514] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe98e40 [0082.514] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0082.515] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0082.515] Wow64DisableWow64FsRedirection (in: OldValue=0x29dfc8c | out: OldValue=0x29dfc8c*=0x0) returned 1 [0082.515] GetProcessHeap () returned 0xe70000 [0082.515] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98e40 | out: hHeap=0xe70000) returned 1 [0082.516] CreatePipe (in: hReadPipe=0x29dfc80, hWritePipe=0x29dfc7c, lpPipeAttributes=0x29dfc9c, nSize=0x0 | out: hReadPipe=0x29dfc80*=0x258, hWritePipe=0x29dfc7c*=0x254) returned 1 [0082.517] CreatePipe (in: hReadPipe=0x29dfc84, hWritePipe=0x29dfc88, lpPipeAttributes=0x29dfc9c, nSize=0x0 | out: hReadPipe=0x29dfc84*=0x210, hWritePipe=0x29dfc88*=0x25c) returned 1 [0082.518] SetHandleInformation (hObject=0x254, dwMask=0x1, dwFlags=0x0) returned 1 [0082.518] SetHandleInformation (hObject=0x210, dwMask=0x1, dwFlags=0x0) returned 1 [0082.518] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x29dfcb8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x258, hStdOutput=0x25c, hStdError=0x25c), lpProcessInformation=0x29dfca8 | out: lpCommandLine=0x0, lpProcessInformation=0x29dfca8*(hProcess=0x264, hThread=0x260, dwProcessId=0x42c, dwThreadId=0xe88)) returned 1 [0083.757] WriteFile (in: hFile=0x254, lpBuffer=0xe76800*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x29dfc98, lpOverlapped=0x0 | out: lpBuffer=0xe76800*, lpNumberOfBytesWritten=0x29dfc98*=0x5b, lpOverlapped=0x0) returned 1 [0083.757] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0xffffffff) Thread: id = 14 os_tid = 0x5f8 [0088.547] GetVersion () returned 0x23f00206 [0088.547] GetCurrentProcess () returned 0xffffffff [0088.547] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2b7f994 | out: TokenHandle=0x2b7f994*=0x2a0) returned 1 [0088.547] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x14, TokenInformation=0x2b7f98c, TokenInformationLength=0x4, ReturnLength=0x2b7f990 | out: TokenInformation=0x2b7f98c, ReturnLength=0x2b7f990) returned 1 [0088.548] CloseHandle (hObject=0x2a0) returned 1 [0088.548] GetProcessHeap () returned 0xe70000 [0088.548] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98108 [0088.548] GetProcessHeap () returned 0xe70000 [0088.548] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe980e0 [0088.548] GetProcessHeap () returned 0xe70000 [0088.548] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98090 [0088.548] GetProcessHeap () returned 0xe70000 [0088.548] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.548] GetProcessHeap () returned 0xe70000 [0088.548] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.548] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe980e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.548] GetProcessHeap () returned 0xe70000 [0088.548] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98090 | out: hHeap=0xe70000) returned 1 [0088.549] GetProcessHeap () returned 0xe70000 [0088.549] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98108 | out: hHeap=0xe70000) returned 1 [0088.549] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.549] GetProcessHeap () returned 0xe70000 [0088.549] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe980e0 | out: hHeap=0xe70000) returned 1 [0088.549] GetProcessHeap () returned 0xe70000 [0088.549] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0088.549] GetProcessHeap () returned 0xe70000 [0088.549] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82818 [0088.549] GetProcessHeap () returned 0xe70000 [0088.550] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82818, Size=0x72) returned 0xe973c8 [0088.550] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2a0 [0088.550] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x0) returned 0x102 [0088.550] CloseHandle (hObject=0x2a0) returned 1 [0088.550] GetProcessHeap () returned 0xe70000 [0088.550] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0088.550] GetProcessHeap () returned 0xe70000 [0088.550] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe973c8 | out: hHeap=0xe70000) returned 1 [0088.550] Sleep (dwMilliseconds=0x3e8) [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe982c0 [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98450 [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe982e8 [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0090.484] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98450, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe982e8 | out: hHeap=0xe70000) returned 1 [0090.484] GetProcessHeap () returned 0xe70000 [0090.484] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe982c0 | out: hHeap=0xe70000) returned 1 [0090.485] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0090.485] GetProcessHeap () returned 0xe70000 [0090.485] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0090.485] GetProcessHeap () returned 0xe70000 [0090.485] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0090.485] GetProcessHeap () returned 0xe70000 [0090.485] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a58 [0090.485] GetProcessHeap () returned 0xe70000 [0090.485] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a58, Size=0x72) returned 0xe96ec8 [0090.485] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f4 [0090.486] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0090.486] CloseHandle (hObject=0x2f4) returned 1 [0090.486] GetProcessHeap () returned 0xe70000 [0090.486] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0090.486] GetProcessHeap () returned 0xe70000 [0090.486] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96ec8 | out: hHeap=0xe70000) returned 1 [0090.486] Sleep (dwMilliseconds=0x3e8) [0091.931] GetProcessHeap () returned 0xe70000 [0091.931] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984c8 [0091.931] GetProcessHeap () returned 0xe70000 [0091.931] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98310 [0091.931] GetProcessHeap () returned 0xe70000 [0091.931] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98450 [0091.931] GetProcessHeap () returned 0xe70000 [0091.931] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0091.931] GetProcessHeap () returned 0xe70000 [0091.931] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0091.931] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98310, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.932] GetProcessHeap () returned 0xe70000 [0091.932] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0091.932] GetProcessHeap () returned 0xe70000 [0091.932] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984c8 | out: hHeap=0xe70000) returned 1 [0091.932] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.932] GetProcessHeap () returned 0xe70000 [0091.932] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98310 | out: hHeap=0xe70000) returned 1 [0091.932] GetProcessHeap () returned 0xe70000 [0091.932] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0091.933] GetProcessHeap () returned 0xe70000 [0091.933] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a58 [0091.933] GetProcessHeap () returned 0xe70000 [0091.933] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a58, Size=0x72) returned 0xe96fc8 [0091.933] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f0 [0091.933] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0091.933] CloseHandle (hObject=0x2f0) returned 1 [0091.933] GetProcessHeap () returned 0xe70000 [0091.933] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0091.933] GetProcessHeap () returned 0xe70000 [0091.933] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96fc8 | out: hHeap=0xe70000) returned 1 [0091.934] Sleep (dwMilliseconds=0x3e8) [0093.352] GetProcessHeap () returned 0xe70000 [0093.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984a0 [0093.352] GetProcessHeap () returned 0xe70000 [0093.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98450 [0093.352] GetProcessHeap () returned 0xe70000 [0093.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe984f0 [0093.352] GetProcessHeap () returned 0xe70000 [0093.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0093.352] GetProcessHeap () returned 0xe70000 [0093.352] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0093.353] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98450, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0093.353] GetProcessHeap () returned 0xe70000 [0093.353] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984f0 | out: hHeap=0xe70000) returned 1 [0093.353] GetProcessHeap () returned 0xe70000 [0093.353] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0093.353] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.353] GetProcessHeap () returned 0xe70000 [0093.353] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0093.353] GetProcessHeap () returned 0xe70000 [0093.353] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a58 [0093.353] GetProcessHeap () returned 0xe70000 [0093.354] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a10 [0093.354] GetProcessHeap () returned 0xe70000 [0093.354] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a10, Size=0x72) returned 0xe96f48 [0093.354] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f0 [0093.354] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0093.354] CloseHandle (hObject=0x2f0) returned 1 [0093.354] GetProcessHeap () returned 0xe70000 [0093.354] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a58 | out: hHeap=0xe70000) returned 1 [0093.354] GetProcessHeap () returned 0xe70000 [0093.354] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96f48 | out: hHeap=0xe70000) returned 1 [0093.355] Sleep (dwMilliseconds=0x3e8) [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984a0 [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98220 [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98310 [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81260 [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81260 | out: hHeap=0xe70000) returned 1 [0094.614] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98220, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98310 | out: hHeap=0xe70000) returned 1 [0094.614] GetProcessHeap () returned 0xe70000 [0094.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0094.615] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.615] GetProcessHeap () returned 0xe70000 [0094.615] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98220 | out: hHeap=0xe70000) returned 1 [0094.615] GetProcessHeap () returned 0xe70000 [0094.615] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0094.615] GetProcessHeap () returned 0xe70000 [0094.615] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82398 [0094.616] GetProcessHeap () returned 0xe70000 [0094.616] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82398, Size=0x72) returned 0xe97248 [0094.616] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x318 [0094.616] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0094.616] CloseHandle (hObject=0x318) returned 1 [0094.616] GetProcessHeap () returned 0xe70000 [0094.616] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0094.616] GetProcessHeap () returned 0xe70000 [0094.616] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97248 | out: hHeap=0xe70000) returned 1 [0094.617] Sleep (dwMilliseconds=0x3e8) [0096.273] GetProcessHeap () returned 0xe70000 [0096.273] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984a0 [0096.273] GetProcessHeap () returned 0xe70000 [0096.273] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98450 [0096.273] GetProcessHeap () returned 0xe70000 [0096.274] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98068 [0096.274] GetProcessHeap () returned 0xe70000 [0096.274] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0096.274] GetProcessHeap () returned 0xe70000 [0096.274] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0096.274] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98450, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0096.274] GetProcessHeap () returned 0xe70000 [0096.274] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98068 | out: hHeap=0xe70000) returned 1 [0096.274] GetProcessHeap () returned 0xe70000 [0096.274] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0096.274] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0096.275] GetProcessHeap () returned 0xe70000 [0096.275] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0096.275] GetProcessHeap () returned 0xe70000 [0096.275] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82ae8 [0096.275] GetProcessHeap () returned 0xe70000 [0096.275] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe824b8 [0096.275] GetProcessHeap () returned 0xe70000 [0096.275] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe824b8, Size=0x72) returned 0xe96fc8 [0096.275] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x308 [0096.276] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0096.276] CloseHandle (hObject=0x308) returned 1 [0096.276] GetProcessHeap () returned 0xe70000 [0096.276] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82ae8 | out: hHeap=0xe70000) returned 1 [0096.276] GetProcessHeap () returned 0xe70000 [0096.276] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96fc8 | out: hHeap=0xe70000) returned 1 [0096.276] Sleep (dwMilliseconds=0x3e8) [0097.455] GetProcessHeap () returned 0xe70000 [0097.456] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984c8 [0097.456] GetProcessHeap () returned 0xe70000 [0097.456] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98130 [0097.456] GetProcessHeap () returned 0xe70000 [0097.456] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98108 [0097.456] GetProcessHeap () returned 0xe70000 [0097.456] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0097.456] GetProcessHeap () returned 0xe70000 [0097.456] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0097.456] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98130, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0097.456] GetProcessHeap () returned 0xe70000 [0097.456] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98108 | out: hHeap=0xe70000) returned 1 [0097.456] GetProcessHeap () returned 0xe70000 [0097.457] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984c8 | out: hHeap=0xe70000) returned 1 [0097.457] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0097.457] GetProcessHeap () returned 0xe70000 [0097.457] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98130 | out: hHeap=0xe70000) returned 1 [0097.457] GetProcessHeap () returned 0xe70000 [0097.457] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0097.457] GetProcessHeap () returned 0xe70000 [0097.457] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a58 [0097.457] GetProcessHeap () returned 0xe70000 [0097.457] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a58, Size=0x72) returned 0xe97348 [0097.458] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2fc [0097.458] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0097.458] CloseHandle (hObject=0x2fc) returned 1 [0097.458] GetProcessHeap () returned 0xe70000 [0097.458] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0097.458] GetProcessHeap () returned 0xe70000 [0097.458] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97348 | out: hHeap=0xe70000) returned 1 [0097.458] Sleep (dwMilliseconds=0x3e8) [0099.159] GetProcessHeap () returned 0xe70000 [0099.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe981a8 [0099.159] GetProcessHeap () returned 0xe70000 [0099.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98130 [0099.159] GetProcessHeap () returned 0xe70000 [0099.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe984a0 [0099.159] GetProcessHeap () returned 0xe70000 [0099.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0099.159] GetProcessHeap () returned 0xe70000 [0099.159] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0099.159] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98130, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0099.160] GetProcessHeap () returned 0xe70000 [0099.160] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0099.160] GetProcessHeap () returned 0xe70000 [0099.160] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0099.160] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0099.160] GetProcessHeap () returned 0xe70000 [0099.160] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98130 | out: hHeap=0xe70000) returned 1 [0099.160] GetProcessHeap () returned 0xe70000 [0099.160] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe824b8 [0099.160] GetProcessHeap () returned 0xe70000 [0099.160] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a10 [0099.160] GetProcessHeap () returned 0xe70000 [0099.161] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a10, Size=0x72) returned 0xe96f48 [0099.161] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x310 [0099.161] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0099.161] CloseHandle (hObject=0x310) returned 1 [0099.161] GetProcessHeap () returned 0xe70000 [0099.161] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe824b8 | out: hHeap=0xe70000) returned 1 [0099.161] GetProcessHeap () returned 0xe70000 [0099.161] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96f48 | out: hHeap=0xe70000) returned 1 [0099.161] Sleep (dwMilliseconds=0x3e8) [0100.502] GetProcessHeap () returned 0xe70000 [0100.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe981a8 [0100.502] GetProcessHeap () returned 0xe70000 [0100.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98090 [0100.502] GetProcessHeap () returned 0xe70000 [0100.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98450 [0100.502] GetProcessHeap () returned 0xe70000 [0100.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81fc0 [0100.502] GetProcessHeap () returned 0xe70000 [0100.502] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0100.503] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.503] GetProcessHeap () returned 0xe70000 [0100.503] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0100.503] GetProcessHeap () returned 0xe70000 [0100.503] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0100.503] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.503] GetProcessHeap () returned 0xe70000 [0100.503] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98090 | out: hHeap=0xe70000) returned 1 [0100.503] GetProcessHeap () returned 0xe70000 [0100.504] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0100.504] GetProcessHeap () returned 0xe70000 [0100.504] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a58 [0100.504] GetProcessHeap () returned 0xe70000 [0100.504] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a58, Size=0x72) returned 0xe971c8 [0100.504] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0100.504] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0100.504] CloseHandle (hObject=0x320) returned 1 [0100.504] GetProcessHeap () returned 0xe70000 [0100.504] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0100.504] GetProcessHeap () returned 0xe70000 [0100.504] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe971c8 | out: hHeap=0xe70000) returned 1 [0100.505] Sleep (dwMilliseconds=0x3e8) [0101.778] GetProcessHeap () returned 0xe70000 [0101.778] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984a0 [0101.778] GetProcessHeap () returned 0xe70000 [0101.778] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe982c0 [0101.779] GetProcessHeap () returned 0xe70000 [0101.779] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98090 [0101.779] GetProcessHeap () returned 0xe70000 [0101.779] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0101.779] GetProcessHeap () returned 0xe70000 [0101.779] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0101.779] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe982c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.779] GetProcessHeap () returned 0xe70000 [0101.779] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98090 | out: hHeap=0xe70000) returned 1 [0101.779] GetProcessHeap () returned 0xe70000 [0101.779] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0101.779] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.780] GetProcessHeap () returned 0xe70000 [0101.780] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe982c0 | out: hHeap=0xe70000) returned 1 [0101.780] GetProcessHeap () returned 0xe70000 [0101.780] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82398 [0101.780] GetProcessHeap () returned 0xe70000 [0101.780] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a10 [0101.780] GetProcessHeap () returned 0xe70000 [0101.780] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a10, Size=0x72) returned 0xe97048 [0101.780] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0101.780] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0101.780] CloseHandle (hObject=0x320) returned 1 [0101.781] GetProcessHeap () returned 0xe70000 [0101.781] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82398 | out: hHeap=0xe70000) returned 1 [0101.781] GetProcessHeap () returned 0xe70000 [0101.781] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97048 | out: hHeap=0xe70000) returned 1 [0101.781] Sleep (dwMilliseconds=0x3e8) [0104.822] GetProcessHeap () returned 0xe70000 [0104.822] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98360 [0104.822] GetProcessHeap () returned 0xe70000 [0104.822] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe984a0 [0104.822] GetProcessHeap () returned 0xe70000 [0104.822] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe981a8 [0104.822] GetProcessHeap () returned 0xe70000 [0104.822] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0104.822] GetProcessHeap () returned 0xe70000 [0104.822] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0104.822] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe984a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0104.823] GetProcessHeap () returned 0xe70000 [0104.823] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0104.823] GetProcessHeap () returned 0xe70000 [0104.823] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98360 | out: hHeap=0xe70000) returned 1 [0104.823] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0104.826] GetProcessHeap () returned 0xe70000 [0104.826] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0104.826] GetProcessHeap () returned 0xe70000 [0104.826] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0104.826] GetProcessHeap () returned 0xe70000 [0104.826] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a58 [0104.826] GetProcessHeap () returned 0xe70000 [0104.827] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a58, Size=0x72) returned 0xe97248 [0104.827] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x338 [0104.828] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0104.829] CloseHandle (hObject=0x338) returned 1 [0104.829] GetProcessHeap () returned 0xe70000 [0104.829] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0104.829] GetProcessHeap () returned 0xe70000 [0104.829] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97248 | out: hHeap=0xe70000) returned 1 [0104.829] Sleep (dwMilliseconds=0x3e8) [0106.435] GetProcessHeap () returned 0xe70000 [0106.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe981a8 [0106.435] GetProcessHeap () returned 0xe70000 [0106.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98450 [0106.435] GetProcessHeap () returned 0xe70000 [0106.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98388 [0106.435] GetProcessHeap () returned 0xe70000 [0106.435] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0106.435] GetProcessHeap () returned 0xe70000 [0106.435] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0106.435] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98450, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0106.435] GetProcessHeap () returned 0xe70000 [0106.435] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98388 | out: hHeap=0xe70000) returned 1 [0106.435] GetProcessHeap () returned 0xe70000 [0106.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0106.436] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0106.436] GetProcessHeap () returned 0xe70000 [0106.436] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0106.436] GetProcessHeap () returned 0xe70000 [0106.436] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0106.436] GetProcessHeap () returned 0xe70000 [0106.436] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a58 [0106.436] GetProcessHeap () returned 0xe70000 [0106.436] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a58, Size=0x72) returned 0xe96e48 [0106.437] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0106.437] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0106.437] CloseHandle (hObject=0x320) returned 1 [0106.437] GetProcessHeap () returned 0xe70000 [0106.437] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0106.437] GetProcessHeap () returned 0xe70000 [0106.437] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96e48 | out: hHeap=0xe70000) returned 1 [0106.437] Sleep (dwMilliseconds=0x3e8) [0108.263] GetProcessHeap () returned 0xe70000 [0108.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98310 [0108.263] GetProcessHeap () returned 0xe70000 [0108.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe981a8 [0108.263] GetProcessHeap () returned 0xe70000 [0108.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98338 [0108.264] GetProcessHeap () returned 0xe70000 [0108.264] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe82e40 [0108.264] GetProcessHeap () returned 0xe70000 [0108.264] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82e40 | out: hHeap=0xe70000) returned 1 [0108.264] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe981a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0108.487] GetProcessHeap () returned 0xe70000 [0108.487] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98338 | out: hHeap=0xe70000) returned 1 [0108.487] GetProcessHeap () returned 0xe70000 [0108.487] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98310 | out: hHeap=0xe70000) returned 1 [0108.487] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0108.488] GetProcessHeap () returned 0xe70000 [0108.488] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0108.488] GetProcessHeap () returned 0xe70000 [0108.488] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe827d0 [0108.488] GetProcessHeap () returned 0xe70000 [0108.488] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82590 [0108.488] GetProcessHeap () returned 0xe70000 [0108.488] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82590, Size=0x72) returned 0xe97248 [0108.489] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x32c [0108.489] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x102 [0108.489] CloseHandle (hObject=0x32c) returned 1 [0108.489] GetProcessHeap () returned 0xe70000 [0108.489] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe827d0 | out: hHeap=0xe70000) returned 1 [0108.489] GetProcessHeap () returned 0xe70000 [0108.489] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97248 | out: hHeap=0xe70000) returned 1 [0108.489] Sleep (dwMilliseconds=0x3e8) [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98220 [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe981f8 [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe981a8 [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81fc0 [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0109.896] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe981f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981a8 | out: hHeap=0xe70000) returned 1 [0109.896] GetProcessHeap () returned 0xe70000 [0109.896] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98220 | out: hHeap=0xe70000) returned 1 [0109.896] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0109.897] GetProcessHeap () returned 0xe70000 [0109.897] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe981f8 | out: hHeap=0xe70000) returned 1 [0109.897] GetProcessHeap () returned 0xe70000 [0109.897] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82a10 [0109.897] GetProcessHeap () returned 0xe70000 [0109.897] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe827d0 [0109.897] GetProcessHeap () returned 0xe70000 [0109.897] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe827d0, Size=0x72) returned 0xe972c8 [0109.897] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x33c [0109.897] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x102 [0109.898] CloseHandle (hObject=0x33c) returned 1 [0109.898] GetProcessHeap () returned 0xe70000 [0109.898] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe82a10 | out: hHeap=0xe70000) returned 1 [0109.898] GetProcessHeap () returned 0xe70000 [0109.898] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe972c8 | out: hHeap=0xe70000) returned 1 [0109.898] Sleep (dwMilliseconds=0x3e8) [0111.536] GetProcessHeap () returned 0xe70000 [0111.560] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98068 [0111.561] GetProcessHeap () returned 0xe70000 [0111.561] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe983b0 [0111.561] GetProcessHeap () returned 0xe70000 [0111.561] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe984c8 [0111.561] GetProcessHeap () returned 0xe70000 [0111.561] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81fc0 [0111.561] GetProcessHeap () returned 0xe70000 [0111.561] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0111.561] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe983b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0111.561] GetProcessHeap () returned 0xe70000 [0111.561] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984c8 | out: hHeap=0xe70000) returned 1 [0111.561] GetProcessHeap () returned 0xe70000 [0111.561] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98068 | out: hHeap=0xe70000) returned 1 [0111.561] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0111.562] GetProcessHeap () returned 0xe70000 [0111.562] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe983b0 | out: hHeap=0xe70000) returned 1 [0111.562] GetProcessHeap () returned 0xe70000 [0111.562] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe827d0 [0111.562] GetProcessHeap () returned 0xe70000 [0111.562] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82a10 [0111.562] GetProcessHeap () returned 0xe70000 [0111.562] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82a10, Size=0x72) returned 0xe96f48 [0111.562] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0111.563] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0111.563] CloseHandle (hObject=0x320) returned 1 [0111.563] GetProcessHeap () returned 0xe70000 [0111.563] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe827d0 | out: hHeap=0xe70000) returned 1 [0111.563] GetProcessHeap () returned 0xe70000 [0111.563] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe96f48 | out: hHeap=0xe70000) returned 1 [0111.563] Sleep (dwMilliseconds=0x3e8) [0113.046] GetProcessHeap () returned 0xe70000 [0113.046] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe984f0 [0113.046] GetProcessHeap () returned 0xe70000 [0113.046] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98018 [0113.046] GetProcessHeap () returned 0xe70000 [0113.046] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe984a0 [0113.046] GetProcessHeap () returned 0xe70000 [0113.046] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81fc0 [0113.191] GetProcessHeap () returned 0xe70000 [0113.191] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0113.191] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98018, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0113.191] GetProcessHeap () returned 0xe70000 [0113.192] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0113.192] GetProcessHeap () returned 0xe70000 [0113.192] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984f0 | out: hHeap=0xe70000) returned 1 [0113.192] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b7f91c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b7f91c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0113.192] GetProcessHeap () returned 0xe70000 [0113.192] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98018 | out: hHeap=0xe70000) returned 1 [0113.192] GetProcessHeap () returned 0xe70000 [0113.192] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe827d0 [0113.192] GetProcessHeap () returned 0xe70000 [0113.192] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3a) returned 0xe82428 [0113.192] GetProcessHeap () returned 0xe70000 [0113.193] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe82428, Size=0x72) returned 0xe97148 [0113.193] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2ac [0113.193] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x0) returned 0x102 [0113.193] CloseHandle (hObject=0x2ac) returned 1 [0113.193] GetProcessHeap () returned 0xe70000 [0113.193] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe827d0 | out: hHeap=0xe70000) returned 1 [0113.193] GetProcessHeap () returned 0xe70000 [0113.193] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97148 | out: hHeap=0xe70000) returned 1 [0113.193] Sleep (dwMilliseconds=0x3e8) Thread: id = 15 os_tid = 0xb80 [0088.551] GetProcessHeap () returned 0xe70000 [0088.551] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x440) returned 0xe9da78 [0088.551] GetProcessHeap () returned 0xe70000 [0088.552] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x434) returned 0xe9dec0 [0088.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2ac [0088.687] Process32FirstW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.688] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.690] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.692] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.693] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.826] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.827] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.829] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.830] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.831] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.833] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.834] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.836] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.837] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.838] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.840] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.841] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.842] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.843] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.845] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.908] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.910] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.911] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.912] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.913] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.915] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.916] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.917] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0088.918] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.920] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.921] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0088.923] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0088.924] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.925] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0088.926] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0088.928] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0088.930] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0088.931] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.933] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.934] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0088.936] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.937] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0088.938] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0088.939] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0088.940] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0088.942] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0088.943] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0090.426] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0090.428] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0090.429] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0090.430] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0090.432] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0090.433] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0090.434] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0090.435] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0090.437] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0090.438] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0090.440] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.442] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.443] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0090.445] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0090.447] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0090.449] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0090.451] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0090.453] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0090.455] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0090.458] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0090.459] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0090.461] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0090.463] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0090.465] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0090.466] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0090.468] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.470] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0090.643] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.649] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.650] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0090.652] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0090.653] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0090.655] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0090.656] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0090.658] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.660] Process32NextW (in: hSnapshot=0x2ac, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0090.661] CloseHandle (hObject=0x2ac) returned 1 [0090.661] Sleep (dwMilliseconds=0x1f4) [0091.590] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0091.603] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.605] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.606] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.607] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.609] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.610] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.612] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.614] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.615] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.617] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.619] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.620] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.621] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.623] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.624] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.626] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.627] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.945] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.946] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.947] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.967] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.968] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.970] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.971] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.973] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.975] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.976] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.977] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0091.978] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.980] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.981] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0091.982] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0091.983] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.985] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0091.986] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0091.987] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0091.989] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0091.990] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.991] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.993] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0091.994] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.995] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0091.996] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0091.998] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0091.999] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0092.000] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0092.001] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0092.002] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0092.393] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0092.395] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0092.396] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0092.400] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0092.401] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0092.402] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0092.403] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0092.404] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0092.405] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0092.407] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.408] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.411] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0092.412] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0092.414] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0092.416] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0092.417] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0092.419] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0092.421] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0092.423] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0092.425] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0092.987] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0092.989] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0092.991] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0092.993] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0092.994] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.996] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0092.998] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.999] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.001] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0093.002] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0093.004] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0093.006] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0093.007] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0093.009] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.010] Process32NextW (in: hSnapshot=0x2f4, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0093.011] CloseHandle (hObject=0x2f4) returned 1 [0093.012] Sleep (dwMilliseconds=0x1f4) [0093.881] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0093.897] Process32FirstW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.898] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.899] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.900] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.902] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.903] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.904] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.905] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.907] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.908] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.909] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.911] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.913] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.914] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.915] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.916] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.918] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.919] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.920] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.921] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.923] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.924] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.270] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.271] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.273] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.274] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.275] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.276] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0094.278] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.279] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.280] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0094.281] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0094.283] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.284] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0094.285] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0094.287] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0094.288] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0094.289] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.290] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.292] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0094.293] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.294] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0094.296] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0094.297] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0094.298] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0094.299] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0094.302] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0094.303] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0094.304] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0094.306] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0094.307] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0094.308] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0094.309] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0094.310] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0094.312] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0094.313] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0094.314] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0094.315] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.569] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.571] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0094.573] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0094.574] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0094.576] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0094.578] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0094.580] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0094.582] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0094.584] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0094.586] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0094.588] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0094.590] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0094.591] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0094.593] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0094.595] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.596] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0094.599] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.600] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.602] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0094.603] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0094.605] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0094.607] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0094.608] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0094.610] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.611] Process32NextW (in: hSnapshot=0x310, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0095.066] CloseHandle (hObject=0x310) returned 1 [0095.066] Sleep (dwMilliseconds=0x1f4) [0096.074] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0096.245] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.246] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.248] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.250] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.251] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.252] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.254] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.255] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.256] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.258] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.259] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.260] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.261] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.262] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.264] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.480] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.512] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.513] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.514] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.516] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.517] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.519] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.520] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.521] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.522] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.524] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.525] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.526] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0096.527] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.529] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.530] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0096.531] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0096.533] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.534] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0096.536] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0096.537] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0096.538] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0096.540] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.541] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.543] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0096.544] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.545] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0096.547] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0096.790] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0096.839] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0096.840] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0096.841] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0096.843] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0096.844] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0096.846] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0096.847] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0096.849] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0096.850] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0096.851] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0096.853] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0096.854] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0096.855] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0096.857] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0096.858] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0096.861] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0096.863] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0096.865] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0096.867] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0096.869] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0096.871] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0096.872] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0096.874] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0097.153] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0097.155] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0097.156] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0097.159] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0097.161] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0097.162] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.164] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0097.166] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.168] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.169] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0097.171] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0097.173] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0097.175] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0097.177] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0097.178] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.180] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0097.181] CloseHandle (hObject=0x2fc) returned 1 [0097.181] Sleep (dwMilliseconds=0x1f4) [0097.756] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0097.770] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.771] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.772] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.774] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.775] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.776] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.777] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.778] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.780] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.781] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.783] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0097.784] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0097.856] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.857] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.858] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.860] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.197] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.198] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.199] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.200] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.202] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.203] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.209] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.210] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0098.212] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.213] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.214] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0098.215] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0098.217] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.218] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.220] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0098.221] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0098.222] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0098.224] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0098.225] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0098.226] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0098.228] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0098.229] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.230] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.231] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0098.233] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.234] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0098.463] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0098.464] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0098.466] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0098.467] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0098.468] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0098.818] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0098.819] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0098.821] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0098.826] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0098.827] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0098.841] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0098.935] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0098.937] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0098.938] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0098.939] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0098.940] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0098.942] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0098.943] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0098.945] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0098.947] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0098.949] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0098.950] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0098.953] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0098.954] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0098.956] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0098.958] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0098.959] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0098.961] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0098.963] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0099.212] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0099.215] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.217] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0099.218] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.220] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.221] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0099.223] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.225] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0099.226] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0099.228] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0099.231] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.232] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0099.233] CloseHandle (hObject=0x2fc) returned 1 [0099.233] Sleep (dwMilliseconds=0x1f4) [0100.058] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0100.073] Process32FirstW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.075] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.076] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.077] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.078] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.080] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.081] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.082] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.084] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.085] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.086] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.087] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.089] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.091] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.092] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.093] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.095] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.096] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.097] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.098] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.100] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.101] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.102] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.104] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.431] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.432] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.434] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.436] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0100.437] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.438] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.439] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0100.441] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0100.442] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.443] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0100.444] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0100.446] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0100.447] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0100.449] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.450] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.451] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0100.452] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.454] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0100.455] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0100.456] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0100.457] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0100.459] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0100.460] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0100.461] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0100.462] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0100.463] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0100.674] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0100.675] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0100.677] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0100.678] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0100.679] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0100.680] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0100.681] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0100.684] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.685] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.687] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0100.689] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0100.690] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0100.692] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0100.694] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0100.696] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0100.698] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0100.700] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0100.701] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0100.703] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0100.705] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0100.706] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0100.708] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0100.709] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.711] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0100.713] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.959] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.012] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0101.014] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0101.016] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0101.017] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0101.019] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0101.020] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.022] Process32NextW (in: hSnapshot=0x30c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0101.023] CloseHandle (hObject=0x30c) returned 1 [0101.024] Sleep (dwMilliseconds=0x1f4) [0101.781] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0101.793] Process32FirstW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.794] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.796] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.797] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.798] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.799] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.800] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.802] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.803] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.804] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.805] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0101.807] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0101.810] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.811] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.813] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.814] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.815] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.816] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.817] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.819] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.820] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.821] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.822] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.574] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0102.575] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.576] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.577] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0102.579] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0102.580] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.581] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.582] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0102.583] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0102.585] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0102.586] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0102.587] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0102.588] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0102.591] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0102.592] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0102.593] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.594] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0102.596] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.597] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0102.598] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0102.599] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0102.601] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0102.602] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0102.603] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0102.605] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0102.606] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0102.608] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0102.609] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0102.610] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0102.611] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0102.613] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0102.614] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0102.615] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0102.616] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0102.618] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.619] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.594] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0104.595] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0104.597] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0104.599] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0104.600] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0104.602] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0104.604] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0104.612] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0104.614] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0104.616] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0104.617] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0104.619] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0104.621] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0104.623] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.625] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0104.626] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.628] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.629] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0104.631] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0104.632] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0104.634] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0104.635] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.933] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.935] Process32NextW (in: hSnapshot=0x320, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0105.936] CloseHandle (hObject=0x320) returned 1 [0105.937] Sleep (dwMilliseconds=0x1f4) [0106.779] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0106.901] Process32FirstW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.902] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.903] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.905] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.906] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.908] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.909] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.912] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.913] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.914] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.915] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.916] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.918] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.919] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.920] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.921] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.218] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.221] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.222] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.223] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.224] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.226] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.227] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.228] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.229] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.230] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.232] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0107.233] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.234] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.236] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0107.237] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0107.238] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.239] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0107.240] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0107.242] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0107.243] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0107.244] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.245] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.247] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0107.248] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.249] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0107.517] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0107.519] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0107.520] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0107.521] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0107.522] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0107.523] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0107.524] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0107.526] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0107.527] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0107.528] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0107.529] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0107.530] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0107.533] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0107.534] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0107.535] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0107.536] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.537] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.539] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0107.541] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0107.542] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0107.544] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0107.546] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0107.549] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0107.554] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0107.557] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0107.559] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0107.561] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0108.574] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0108.575] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0108.577] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0108.579] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.582] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0108.583] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.585] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.586] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0108.587] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.589] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0108.590] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0108.592] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0108.597] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.598] Process32NextW (in: hSnapshot=0x33c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0108.599] CloseHandle (hObject=0x33c) returned 1 [0108.599] Sleep (dwMilliseconds=0x1f4) [0109.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0109.363] Process32FirstW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.364] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.365] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.367] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.368] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.369] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.370] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.372] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.373] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.374] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.375] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.377] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.379] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.380] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.381] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.382] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.383] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.385] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.386] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.387] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.388] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.389] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.390] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.731] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.732] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.733] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.734] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.736] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0109.737] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.738] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.740] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0109.741] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0109.742] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.743] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0109.745] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0109.746] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0109.747] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0109.748] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.749] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.751] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0109.752] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.754] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0109.755] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0109.756] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0109.757] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0109.759] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0109.760] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0109.761] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0109.762] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0109.763] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0109.765] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0109.766] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0110.060] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0110.062] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0110.064] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0110.065] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0110.066] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0110.068] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0110.069] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0110.071] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0110.072] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0110.074] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0110.076] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0110.077] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0110.080] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0110.082] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0110.084] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0110.086] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0110.087] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0110.089] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0110.091] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0110.092] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0110.094] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.095] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0110.541] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0110.543] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.544] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0110.546] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0110.547] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe")) returned 1 [0110.549] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0110.550] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe94, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0110.552] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0110.553] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0110.554] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0110.569] Process32NextW (in: hSnapshot=0x31c, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0110.571] CloseHandle (hObject=0x31c) returned 1 [0110.571] Sleep (dwMilliseconds=0x1f4) [0111.752] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0111.781] Process32FirstW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.782] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0111.784] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0111.785] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.786] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0111.788] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.789] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0111.791] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0111.792] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0111.793] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.795] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0111.796] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0111.797] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.799] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0111.800] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.801] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.803] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.804] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.573] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.574] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.575] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.576] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.578] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.579] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.580] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.581] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.583] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.584] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0112.585] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.587] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.588] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0112.590] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0112.591] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.592] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0112.593] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0112.595] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0112.596] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0112.597] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.598] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.599] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0112.601] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.602] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0112.604] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0112.605] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0112.606] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0112.607] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0112.609] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0112.610] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgeempty.exe")) returned 1 [0112.612] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ixtelephonyreligion.exe")) returned 1 [0112.613] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brush_spirit.exe")) returned 1 [0112.614] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production.exe")) returned 1 [0112.615] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="yea.exe")) returned 1 [0112.617] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-chubby.exe")) returned 1 [0113.047] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="seeks.exe")) returned 1 [0113.048] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="looked.exe")) returned 1 [0113.050] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks_centre.exe")) returned 1 [0113.051] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sector.exe")) returned 1 [0113.052] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4b8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0113.054] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0113.056] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="accessory stream.exe")) returned 1 [0113.058] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miles charity aging.exe")) returned 1 [0113.060] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forming-mm-manager.exe")) returned 1 [0113.062] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="favors_disagree_letting.exe")) returned 1 [0113.064] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian.exe")) returned 1 [0113.066] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mid_developer.exe")) returned 1 [0113.068] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="housewives.exe")) returned 1 [0113.070] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rank.exe")) returned 1 [0113.072] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="comingwarned.exe")) returned 1 [0113.074] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0113.075] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="runceramic.exe")) returned 1 [0113.077] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball_acquisition_rebel.exe")) returned 1 [0113.079] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reason.exe")) returned 1 [0113.081] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.082] Process32NextW (in: hSnapshot=0x304, lppe=0x2c7f7cc | out: lppe=0x2c7f7cc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0113.085] Process32NextW (hSnapshot=0x304, lppe=0x2c7f7cc) Thread: id = 16 os_tid = 0xf4c [0088.588] GetProcessHeap () returned 0xe70000 [0088.588] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x21a) returned 0xe9ebe0 [0088.588] GetProcessHeap () returned 0xe70000 [0088.588] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe86b88 [0088.588] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0088.588] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a4 [0088.588] GetComputerNameW (in: lpBuffer=0xe9ebf0, nSize=0x2dbfc58 | out: lpBuffer="NQDPDE", nSize=0x2dbfc58) returned 1 [0088.588] GetProcessHeap () returned 0xe70000 [0088.588] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe980e0 [0088.589] CloseHandle (hObject=0x2a4) returned 1 [0088.589] CloseHandle (hObject=0x2a0) returned 1 [0088.589] GetProcessHeap () returned 0xe70000 [0088.589] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe86b88 | out: hHeap=0xe70000) returned 1 [0088.589] GetProcessHeap () returned 0xe70000 [0088.589] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe980e0 | out: hHeap=0xe70000) returned 1 [0088.589] GetProcessHeap () returned 0xe70000 [0088.589] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ebe0 | out: hHeap=0xe70000) returned 1 Thread: id = 17 os_tid = 0xf0 [0088.591] GetLogicalDrives () returned 0x4 [0088.592] GetProcessHeap () returned 0xe70000 [0088.592] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe82818 [0088.592] GetProcessHeap () returned 0xe70000 [0088.592] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe86b88 [0088.592] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0088.592] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a4 [0088.592] GetProcessHeap () returned 0xe70000 [0088.592] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98090 [0088.592] GetProcessHeap () returned 0xe70000 [0088.592] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe984a0 [0088.592] GetProcessHeap () returned 0xe70000 [0088.592] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe98450 [0088.592] GetProcessHeap () returned 0xe70000 [0088.592] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.593] GetProcessHeap () returned 0xe70000 [0088.593] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.593] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe984a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.593] GetProcessHeap () returned 0xe70000 [0088.593] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0088.593] GetProcessHeap () returned 0xe70000 [0088.593] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98090 | out: hHeap=0xe70000) returned 1 [0088.593] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2eff834, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2eff834*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.594] GetProcessHeap () returned 0xe70000 [0088.594] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe984a0 | out: hHeap=0xe70000) returned 1 [0088.594] GetProcessHeap () returned 0xe70000 [0088.594] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97ed8 [0088.594] GetProcessHeap () returned 0xe70000 [0088.594] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c98 [0088.594] GetProcessHeap () returned 0xe70000 [0088.594] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97cb0 [0088.594] GetProcessHeap () returned 0xe70000 [0088.594] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.595] GetProcessHeap () returned 0xe70000 [0088.595] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97ef0 [0088.595] htonl (hostlong=0xb4197730) returned 0x307719b4 [0088.595] QueryPerformanceCounter (in: lpPerformanceCount=0x2eff730 | out: lpPerformanceCount=0x2eff730*=17932069620) returned 1 [0088.595] GetTickCount () returned 0x11564d1 [0088.595] GetCurrentProcessId () returned 0xe94 [0088.595] GetCurrentThreadId () returned 0xf0 [0088.595] GetLocalTime (in: lpSystemTime=0x2eff718 | out: lpSystemTime=0x2eff718*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x4, wDay=0x2, wHour=0xb, wMinute=0xd, wSecond=0x20, wMilliseconds=0x22a)) [0088.596] SystemTimeToFileTime (in: lpSystemTime=0x2eff718, lpFileTime=0x2eff728 | out: lpFileTime=0x2eff728) returned 1 [0088.596] QueryPerformanceCounter (in: lpPerformanceCount=0x2eff730 | out: lpPerformanceCount=0x2eff730*=17932127773) returned 1 [0088.596] GetProcessHeap () returned 0xe70000 [0088.596] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x28) returned 0xe86a68 [0088.596] GetProcessHeap () returned 0xe70000 [0088.596] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97cf8 [0088.596] GetProcessHeap () returned 0xe70000 [0088.596] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9ad88 [0088.596] GetProcessHeap () returned 0xe70000 [0088.596] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe88200 [0088.596] GetProcessHeap () returned 0xe70000 [0088.596] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97d10 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe81fc0 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c08 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe81260 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c20 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9ac58 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c68 [0088.597] GetProcessHeap () returned 0xe70000 [0088.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe800f0 [0088.597] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f80 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x2) returned 0xe9abe8 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9acf8 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f98 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe80178 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97fb0 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9ac68 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe9abe8, Size=0x82) returned 0xe7fae8 [0088.598] GetProcessHeap () returned 0xe70000 [0088.598] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe9ac68, Size=0x100) returned 0xe81760 [0088.599] GetProcessHeap () returned 0xe70000 [0088.599] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97fc8 [0088.599] GetProcessHeap () returned 0xe70000 [0088.599] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe81868 [0088.599] GetProcessHeap () returned 0xe70000 [0088.599] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f08 [0088.599] GetProcessHeap () returned 0xe70000 [0088.599] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe9ebe0 [0088.599] GetProcessHeap () returned 0xe70000 [0088.599] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe7fae8, Size=0x104) returned 0xe7fae8 [0088.599] GetProcessHeap () returned 0xe70000 [0088.599] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81760, Size=0x200) returned 0xe9ec70 [0088.601] GetProcessHeap () returned 0xe70000 [0088.601] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9acf8 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ec70 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97fb0 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe800f0 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c68 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe80178 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f98 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7fae8 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f80 | out: hHeap=0xe70000) returned 1 [0088.602] GetProcessHeap () returned 0xe70000 [0088.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81868 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97fc8 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ebe0 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f08 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ad88 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97cf8 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81260 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c08 | out: hHeap=0xe70000) returned 1 [0088.603] GetProcessHeap () returned 0xe70000 [0088.603] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97d10 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ac58 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c20 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe86a68 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe88200 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xa4) returned 0xe80ff0 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c98 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97cb0 | out: hHeap=0xe70000) returned 1 [0088.604] GetProcessHeap () returned 0xe70000 [0088.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.605] GetProcessHeap () returned 0xe70000 [0088.605] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97ef0 | out: hHeap=0xe70000) returned 1 [0088.605] GetProcessHeap () returned 0xe70000 [0088.605] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97ed8 | out: hHeap=0xe70000) returned 1 [0088.605] GetProcessHeap () returned 0xe70000 [0088.605] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x14) returned 0xe88300 [0088.605] GetProcessHeap () returned 0xe70000 [0088.605] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xe) returned 0xe97ed8 [0088.605] ResetEvent (hEvent=0x2a4) returned 1 [0088.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd4a4c, lpParameter=0xe88300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0088.606] CloseHandle (hObject=0x2a8) returned 1 [0088.607] GetProcessHeap () returned 0xe70000 [0088.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97ef0 [0088.607] GetProcessHeap () returned 0xe70000 [0088.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c08 [0088.607] GetProcessHeap () returned 0xe70000 [0088.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c20 [0088.607] GetProcessHeap () returned 0xe70000 [0088.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0088.607] GetProcessHeap () returned 0xe70000 [0088.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c68 [0088.607] htonl (hostlong=0xb4197730) returned 0x307719b4 [0088.607] GetProcessHeap () returned 0xe70000 [0088.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x28) returned 0xe86bb8 [0088.607] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97c98 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9aec8 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe883c0 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97cb0 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe81fc0 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97cf8 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe81260 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97d10 [0088.608] GetProcessHeap () returned 0xe70000 [0088.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9ae08 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f68 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe7fae8 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f80 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x2) returned 0xe9ae78 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9ae18 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f98 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe7fb70 [0088.609] GetProcessHeap () returned 0xe70000 [0088.609] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97f20 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe9af38 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe9ae78, Size=0x82) returned 0xe800f0 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe9af38, Size=0x100) returned 0xe81760 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97fb0 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe81868 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe97fc8 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe9ebe0 [0088.610] GetProcessHeap () returned 0xe70000 [0088.610] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe800f0, Size=0x104) returned 0xe800f0 [0088.611] GetProcessHeap () returned 0xe70000 [0088.611] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe81760, Size=0x200) returned 0xe9ec70 [0088.612] GetProcessHeap () returned 0xe70000 [0088.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ae18 | out: hHeap=0xe70000) returned 1 [0088.612] GetProcessHeap () returned 0xe70000 [0088.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ec70 | out: hHeap=0xe70000) returned 1 [0088.612] GetProcessHeap () returned 0xe70000 [0088.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f20 | out: hHeap=0xe70000) returned 1 [0088.612] GetProcessHeap () returned 0xe70000 [0088.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7fae8 | out: hHeap=0xe70000) returned 1 [0088.612] GetProcessHeap () returned 0xe70000 [0088.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f68 | out: hHeap=0xe70000) returned 1 [0088.612] GetProcessHeap () returned 0xe70000 [0088.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7fb70 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f98 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe800f0 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97f80 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81868 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97fb0 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ebe0 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97fc8 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.613] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9aec8 | out: hHeap=0xe70000) returned 1 [0088.613] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c98 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81260 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97cf8 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81fc0 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97cb0 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe9ae08 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97d10 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe86bb8 | out: hHeap=0xe70000) returned 1 [0088.614] GetProcessHeap () returned 0xe70000 [0088.614] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe883c0 | out: hHeap=0xe70000) returned 1 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xa4) returned 0xe807b0 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c08 | out: hHeap=0xe70000) returned 1 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c20 | out: hHeap=0xe70000) returned 1 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97c68 | out: hHeap=0xe70000) returned 1 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe97ef0 | out: hHeap=0xe70000) returned 1 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x14) returned 0xe88140 [0088.615] GetProcessHeap () returned 0xe70000 [0088.615] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xe) returned 0xe97c68 [0088.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd4a4c, lpParameter=0xe88140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0088.617] CloseHandle (hObject=0x2a8) returned 1 [0088.620] WaitForSingleObject (hHandle=0x2a4, dwMilliseconds=0xffffffff) Thread: id = 18 os_tid = 0x4f0 [0088.847] GetProcessHeap () returned 0xe70000 [0088.847] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x38) returned 0xe892c0 [0088.847] GetProcessHeap () returned 0xe70000 [0088.847] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x18) returned 0xe880a0 [0088.847] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b0 [0088.847] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b4 [0088.847] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b8 [0088.848] GetProcessHeap () returned 0xe70000 [0088.848] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xe9f4c0 [0090.408] GetProcessHeap () returned 0xe70000 [0090.408] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe99100 [0090.409] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0090.409] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0090.409] Wow64DisableWow64FsRedirection (in: OldValue=0x2dbfaa4 | out: OldValue=0x2dbfaa4*=0x0) returned 1 [0090.409] GetProcessHeap () returned 0xe70000 [0090.409] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe99100 | out: hHeap=0xe70000) returned 1 [0090.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xd48ba, lpParameter=0x2dbfaa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0090.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xd48ba, lpParameter=0x2dbfaa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0090.412] GetProcessHeap () returned 0xe70000 [0090.412] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xef34a8 [0090.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xe893c0 [0090.414] GetProcessHeap () returned 0xe70000 [0090.414] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0090.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0090.415] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0090.416] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Logs", cAlternateFileName="")) returned 1 [0090.416] GetProcessHeap () returned 0xe70000 [0090.416] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf144c0 [0090.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0090.419] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.419] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0090.419] SetEvent (hEvent=0x2b4) returned 1 [0090.420] ResetEvent (hEvent=0x2b8) returned 1 [0090.420] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0090.420] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0090.420] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0090.420] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0090.422] GetProcessHeap () returned 0xe70000 [0090.422] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf144c0 | out: hHeap=0xe70000) returned 1 [0090.423] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0090.423] GetProcessHeap () returned 0xe70000 [0090.424] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf144c0 [0090.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0090.642] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.985] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0090.985] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0090.985] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0090.986] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0090.986] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0090.986] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0090.986] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0090.989] GetProcessHeap () returned 0xe70000 [0090.989] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf144c0 | out: hHeap=0xe70000) returned 1 [0090.989] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0090.989] FindClose (in: hFindFile=0xe894c0 | out: hFindFile=0xe894c0) returned 1 [0090.989] GetProcessHeap () returned 0xe70000 [0090.989] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0090.991] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0090.991] GetProcessHeap () returned 0xe70000 [0090.991] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0090.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0090.992] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0090.992] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0090.993] GetProcessHeap () returned 0xe70000 [0090.993] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0090.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0090.993] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.993] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.993] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.994] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0090.994] GetProcessHeap () returned 0xe70000 [0090.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0090.994] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0090.994] GetProcessHeap () returned 0xe70000 [0090.994] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0090.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0090.994] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.994] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.995] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.995] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0090.995] GetProcessHeap () returned 0xe70000 [0090.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0090.995] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0090.995] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0090.995] GetProcessHeap () returned 0xe70000 [0090.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0090.996] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0090.997] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0090.997] GetProcessHeap () returned 0xe70000 [0090.997] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0090.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.998] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0090.999] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1025", cAlternateFileName="")) returned 1 [0090.999] GetProcessHeap () returned 0xe70000 [0090.999] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0090.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0090.999] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.999] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.999] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.000] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.000] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.000] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.000] GetProcessHeap () returned 0xe70000 [0091.000] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.000] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1028", cAlternateFileName="")) returned 1 [0091.000] GetProcessHeap () returned 0xe70000 [0091.000] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.001] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.001] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.001] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.001] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.002] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.002] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.002] GetProcessHeap () returned 0xe70000 [0091.002] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.002] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1029", cAlternateFileName="")) returned 1 [0091.002] GetProcessHeap () returned 0xe70000 [0091.002] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.002] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.003] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.003] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.003] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.004] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.004] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.004] GetProcessHeap () returned 0xe70000 [0091.004] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.004] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1030", cAlternateFileName="")) returned 1 [0091.004] GetProcessHeap () returned 0xe70000 [0091.004] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.005] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.005] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.005] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.005] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.006] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.006] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.006] GetProcessHeap () returned 0xe70000 [0091.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.006] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1031", cAlternateFileName="")) returned 1 [0091.006] GetProcessHeap () returned 0xe70000 [0091.006] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.006] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.006] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.007] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.007] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.007] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.007] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.008] GetProcessHeap () returned 0xe70000 [0091.008] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.008] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1032", cAlternateFileName="")) returned 1 [0091.008] GetProcessHeap () returned 0xe70000 [0091.008] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.008] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.008] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.009] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.009] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.009] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.009] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.011] GetProcessHeap () returned 0xe70000 [0091.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.011] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1033", cAlternateFileName="")) returned 1 [0091.011] GetProcessHeap () returned 0xe70000 [0091.011] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0091.012] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.012] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.012] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.012] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.013] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.013] FindClose (in: hFindFile=0xe894c0 | out: hFindFile=0xe894c0) returned 1 [0091.013] GetProcessHeap () returned 0xe70000 [0091.013] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.013] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1035", cAlternateFileName="")) returned 1 [0091.013] GetProcessHeap () returned 0xe70000 [0091.013] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.015] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.015] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.015] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.015] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.015] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.016] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.016] GetProcessHeap () returned 0xe70000 [0091.016] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.016] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1036", cAlternateFileName="")) returned 1 [0091.016] GetProcessHeap () returned 0xe70000 [0091.016] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.017] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.018] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.018] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.018] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.018] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.018] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.018] GetProcessHeap () returned 0xe70000 [0091.019] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.020] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1037", cAlternateFileName="")) returned 1 [0091.020] GetProcessHeap () returned 0xe70000 [0091.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.020] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.020] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.021] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.021] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.021] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.021] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.021] GetProcessHeap () returned 0xe70000 [0091.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.022] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1038", cAlternateFileName="")) returned 1 [0091.022] GetProcessHeap () returned 0xe70000 [0091.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0091.022] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.022] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.023] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.023] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.023] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.023] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.023] GetProcessHeap () returned 0xe70000 [0091.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.024] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1040", cAlternateFileName="")) returned 1 [0091.024] GetProcessHeap () returned 0xe70000 [0091.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.025] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.025] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.025] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.026] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.026] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.026] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.026] GetProcessHeap () returned 0xe70000 [0091.026] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.026] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1041", cAlternateFileName="")) returned 1 [0091.027] GetProcessHeap () returned 0xe70000 [0091.027] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.028] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.028] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.028] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.028] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.029] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.029] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.029] GetProcessHeap () returned 0xe70000 [0091.029] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.029] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1042", cAlternateFileName="")) returned 1 [0091.029] GetProcessHeap () returned 0xe70000 [0091.029] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0091.030] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.030] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.030] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.030] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.031] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.031] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0091.031] GetProcessHeap () returned 0xe70000 [0091.031] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.031] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1043", cAlternateFileName="")) returned 1 [0091.031] GetProcessHeap () returned 0xe70000 [0091.031] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0091.032] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.032] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.032] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.032] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.032] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.032] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0091.033] GetProcessHeap () returned 0xe70000 [0091.033] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.033] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1044", cAlternateFileName="")) returned 1 [0091.033] GetProcessHeap () returned 0xe70000 [0091.033] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0091.301] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.301] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.301] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.302] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.302] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.302] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.316] GetProcessHeap () returned 0xe70000 [0091.316] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.316] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1045", cAlternateFileName="")) returned 1 [0091.317] GetProcessHeap () returned 0xe70000 [0091.317] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.317] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.317] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.318] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.318] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.318] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.318] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.318] GetProcessHeap () returned 0xe70000 [0091.318] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.318] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1046", cAlternateFileName="")) returned 1 [0091.319] GetProcessHeap () returned 0xe70000 [0091.319] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.319] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.319] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.319] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.320] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.320] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.320] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.320] GetProcessHeap () returned 0xe70000 [0091.320] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.320] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1049", cAlternateFileName="")) returned 1 [0091.320] GetProcessHeap () returned 0xe70000 [0091.321] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0091.321] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.321] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.321] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.321] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.322] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.322] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0091.322] GetProcessHeap () returned 0xe70000 [0091.322] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.322] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1053", cAlternateFileName="")) returned 1 [0091.322] GetProcessHeap () returned 0xe70000 [0091.322] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0091.323] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.323] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.323] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.323] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.324] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.324] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0091.324] GetProcessHeap () returned 0xe70000 [0091.324] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.324] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1055", cAlternateFileName="")) returned 1 [0091.324] GetProcessHeap () returned 0xe70000 [0091.324] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0091.325] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.325] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.325] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.325] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.326] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.326] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0091.326] GetProcessHeap () returned 0xe70000 [0091.326] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.326] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="2052", cAlternateFileName="")) returned 1 [0091.326] GetProcessHeap () returned 0xe70000 [0091.326] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0091.327] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.327] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.327] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.327] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.328] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.328] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0091.328] GetProcessHeap () returned 0xe70000 [0091.328] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.328] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="2070", cAlternateFileName="")) returned 1 [0091.328] GetProcessHeap () returned 0xe70000 [0091.328] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0091.328] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.329] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.329] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.329] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.329] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.329] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0091.330] GetProcessHeap () returned 0xe70000 [0091.330] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.330] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="3076", cAlternateFileName="")) returned 1 [0091.330] GetProcessHeap () returned 0xe70000 [0091.330] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0091.330] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.330] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.333] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.333] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.333] GetProcessHeap () returned 0xe70000 [0091.333] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.333] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="3082", cAlternateFileName="")) returned 1 [0091.333] GetProcessHeap () returned 0xe70000 [0091.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.334] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.334] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.334] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.334] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.335] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.335] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.335] GetProcessHeap () returned 0xe70000 [0091.335] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.335] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Client", cAlternateFileName="")) returned 1 [0091.335] GetProcessHeap () returned 0xe70000 [0091.335] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.336] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.336] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0091.336] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0091.336] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0091.336] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.337] GetProcessHeap () returned 0xe70000 [0091.337] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.337] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0091.337] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0091.337] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Extended", cAlternateFileName="")) returned 1 [0091.337] GetProcessHeap () returned 0xe70000 [0091.337] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.338] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.338] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0091.338] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0091.338] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0091.338] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.339] GetProcessHeap () returned 0xe70000 [0091.339] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.339] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Graphics", cAlternateFileName="")) returned 1 [0091.339] GetProcessHeap () returned 0xe70000 [0091.339] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0091.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0091.341] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.341] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0091.342] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0091.342] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0091.342] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0091.342] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0091.343] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0091.343] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0091.343] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0091.343] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0091.344] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0091.344] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0091.344] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0091.344] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0091.345] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0091.345] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0091.345] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0091.345] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.757] GetProcessHeap () returned 0xe70000 [0091.757] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0091.757] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0091.758] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0091.758] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0091.758] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0091.758] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0091.759] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0091.759] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0091.760] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0091.760] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0091.760] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0091.760] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0091.761] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0091.761] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0091.761] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0091.761] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0091.762] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0091.762] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0091.762] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0091.763] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0091.763] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0091.763] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0091.764] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0091.764] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0091.764] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0091.764] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0091.765] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0091.765] GetProcessHeap () returned 0xe70000 [0091.765] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0091.765] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="Boot", cAlternateFileName="")) returned 1 [0091.765] GetProcessHeap () returned 0xe70000 [0091.765] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0091.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0092.205] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0092.205] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD", cAlternateFileName="")) returned 1 [0092.206] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0092.206] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0092.206] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0092.207] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0092.207] GetProcessHeap () returned 0xe70000 [0092.207] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.207] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.207] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.208] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.208] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.208] GetProcessHeap () returned 0xe70000 [0092.208] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.208] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0092.209] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0092.209] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0092.209] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0092.209] GetProcessHeap () returned 0xe70000 [0092.209] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.210] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.210] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.210] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.210] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.211] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.211] GetProcessHeap () returned 0xe70000 [0092.211] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.211] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="da-DK", cAlternateFileName="")) returned 1 [0092.211] GetProcessHeap () returned 0xe70000 [0092.211] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.211] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.212] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.212] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.212] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.212] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.212] GetProcessHeap () returned 0xe70000 [0092.212] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.213] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="de-DE", cAlternateFileName="")) returned 1 [0092.213] GetProcessHeap () returned 0xe70000 [0092.213] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.213] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.213] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.214] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.214] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.214] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.214] GetProcessHeap () returned 0xe70000 [0092.214] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.214] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="el-GR", cAlternateFileName="")) returned 1 [0092.214] GetProcessHeap () returned 0xe70000 [0092.214] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.215] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.215] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.215] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.216] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.216] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.216] GetProcessHeap () returned 0xe70000 [0092.216] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.216] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="en-GB", cAlternateFileName="")) returned 1 [0092.216] GetProcessHeap () returned 0xe70000 [0092.216] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.216] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.217] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.217] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.217] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.217] GetProcessHeap () returned 0xe70000 [0092.217] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.217] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.218] GetProcessHeap () returned 0xe70000 [0092.218] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.218] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.218] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.218] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.219] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.219] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.219] GetProcessHeap () returned 0xe70000 [0092.219] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.219] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="es-ES", cAlternateFileName="")) returned 1 [0092.219] GetProcessHeap () returned 0xe70000 [0092.219] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0092.220] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.220] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.220] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.220] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.220] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0092.221] GetProcessHeap () returned 0xe70000 [0092.221] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.221] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="es-MX", cAlternateFileName="")) returned 1 [0092.221] GetProcessHeap () returned 0xe70000 [0092.221] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0092.221] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.221] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.223] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.223] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0092.223] GetProcessHeap () returned 0xe70000 [0092.223] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.223] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="et-EE", cAlternateFileName="")) returned 1 [0092.224] GetProcessHeap () returned 0xe70000 [0092.224] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.224] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.224] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.224] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.225] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.225] GetProcessHeap () returned 0xe70000 [0092.225] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.225] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0092.225] GetProcessHeap () returned 0xe70000 [0092.225] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.225] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.225] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.226] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.226] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.226] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.226] GetProcessHeap () returned 0xe70000 [0092.226] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.226] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Fonts", cAlternateFileName="")) returned 1 [0092.227] GetProcessHeap () returned 0xe70000 [0092.227] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0092.229] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.229] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0092.230] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0092.230] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0092.230] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0092.230] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0092.231] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0092.231] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0092.231] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0092.232] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0092.232] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0092.232] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0092.232] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0092.233] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0092.233] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0092.234] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0092.234] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0092.234] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0092.234] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0092.236] GetProcessHeap () returned 0xe70000 [0092.236] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.237] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0092.237] GetProcessHeap () returned 0xe70000 [0092.237] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.237] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0092.237] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.237] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.483] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.484] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0092.798] GetProcessHeap () returned 0xe70000 [0092.798] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.798] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0092.798] GetProcessHeap () returned 0xe70000 [0092.798] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.799] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.799] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.799] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.799] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.800] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.800] GetProcessHeap () returned 0xe70000 [0092.800] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.854] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0092.854] GetProcessHeap () returned 0xe70000 [0092.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0092.854] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.855] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.855] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.855] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0092.855] GetProcessHeap () returned 0xe70000 [0092.855] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.855] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0092.856] GetProcessHeap () returned 0xe70000 [0092.856] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.856] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.856] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.856] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.857] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.857] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.857] GetProcessHeap () returned 0xe70000 [0092.857] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.857] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="it-IT", cAlternateFileName="")) returned 1 [0092.857] GetProcessHeap () returned 0xe70000 [0092.857] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.858] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.858] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.858] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.859] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.859] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.859] GetProcessHeap () returned 0xe70000 [0092.859] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.859] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0092.859] GetProcessHeap () returned 0xe70000 [0092.859] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.860] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.860] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.860] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.860] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.860] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.860] GetProcessHeap () returned 0xe70000 [0092.860] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.861] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0092.861] GetProcessHeap () returned 0xe70000 [0092.861] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.861] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.861] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.862] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.862] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.862] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.862] GetProcessHeap () returned 0xe70000 [0092.862] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.862] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0092.863] GetProcessHeap () returned 0xe70000 [0092.863] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.863] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.863] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.863] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.863] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.864] GetProcessHeap () returned 0xe70000 [0092.864] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.864] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0092.864] GetProcessHeap () returned 0xe70000 [0092.864] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.864] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.864] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.865] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.865] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.865] GetProcessHeap () returned 0xe70000 [0092.865] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.865] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0092.865] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0092.865] GetProcessHeap () returned 0xe70000 [0092.866] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.866] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.866] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.866] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.867] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.867] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.867] GetProcessHeap () returned 0xe70000 [0092.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.867] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0092.867] GetProcessHeap () returned 0xe70000 [0092.867] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.867] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.868] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.868] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.868] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.868] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.868] GetProcessHeap () returned 0xe70000 [0092.868] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.868] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0092.869] GetProcessHeap () returned 0xe70000 [0092.869] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.869] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.869] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.869] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.870] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.870] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.870] GetProcessHeap () returned 0xe70000 [0092.870] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.870] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0092.870] GetProcessHeap () returned 0xe70000 [0092.870] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0092.871] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.871] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.871] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.871] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.871] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0092.872] GetProcessHeap () returned 0xe70000 [0092.872] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.872] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0092.872] GetProcessHeap () returned 0xe70000 [0092.872] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.872] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.872] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.873] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.873] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.873] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.873] GetProcessHeap () returned 0xe70000 [0092.873] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.873] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0092.873] GetProcessHeap () returned 0xe70000 [0092.873] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.874] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.874] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.874] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.874] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.874] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.875] GetProcessHeap () returned 0xe70000 [0092.875] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.875] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0092.875] GetProcessHeap () returned 0xe70000 [0092.875] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.875] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.875] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0092.876] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.876] GetProcessHeap () returned 0xe70000 [0092.876] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38f0878 [0092.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.877] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.877] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0092.878] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0092.878] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.878] GetProcessHeap () returned 0xe70000 [0092.878] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38f0878 | out: hHeap=0xe70000) returned 1 [0092.878] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0092.878] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.879] GetProcessHeap () returned 0xe70000 [0092.879] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.880] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0092.880] GetProcessHeap () returned 0xe70000 [0092.880] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.881] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.881] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.881] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.882] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.882] GetProcessHeap () returned 0xe70000 [0092.882] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.882] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0092.882] GetProcessHeap () returned 0xe70000 [0092.882] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.882] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.882] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.883] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.883] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.883] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.883] GetProcessHeap () returned 0xe70000 [0092.883] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.883] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0092.884] GetProcessHeap () returned 0xe70000 [0092.884] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.884] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.884] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.884] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.884] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.885] GetProcessHeap () returned 0xe70000 [0092.885] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.885] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0092.885] GetProcessHeap () returned 0xe70000 [0092.885] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.885] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.885] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.886] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.886] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.886] GetProcessHeap () returned 0xe70000 [0092.886] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.886] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0092.886] GetProcessHeap () returned 0xe70000 [0092.886] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.886] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.887] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.887] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.887] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.887] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.887] GetProcessHeap () returned 0xe70000 [0092.887] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0092.887] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0092.888] GetProcessHeap () returned 0xe70000 [0092.888] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0092.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0093.296] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.296] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.296] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0093.296] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0093.297] GetProcessHeap () returned 0xe70000 [0093.297] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.297] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0093.297] GetProcessHeap () returned 0xe70000 [0093.297] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0093.297] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.297] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.298] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.298] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.298] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0093.298] GetProcessHeap () returned 0xe70000 [0093.298] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.298] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0093.298] GetProcessHeap () returned 0xe70000 [0093.299] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0093.299] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.299] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.299] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.300] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.300] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0093.300] GetProcessHeap () returned 0xe70000 [0093.301] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.301] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0093.301] GetProcessHeap () returned 0xe70000 [0093.301] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0093.301] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.301] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0093.302] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0093.302] GetProcessHeap () returned 0xe70000 [0093.302] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.302] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0093.302] GetProcessHeap () returned 0xe70000 [0093.302] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0093.303] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.303] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.303] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.303] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.304] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0093.304] GetProcessHeap () returned 0xe70000 [0093.304] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.304] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0093.304] GetProcessHeap () returned 0xe70000 [0093.304] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.304] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.304] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.305] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.305] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.305] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.305] GetProcessHeap () returned 0xe70000 [0093.305] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.305] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0093.306] GetProcessHeap () returned 0xe70000 [0093.306] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0093.306] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.306] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.306] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.307] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.307] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0093.307] GetProcessHeap () returned 0xe70000 [0093.307] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0093.307] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0093.307] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0093.307] GetProcessHeap () returned 0xe70000 [0093.307] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0093.308] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0093.309] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0093.309] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1e9910d, dwReserved1=0x745f9fc4, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0093.309] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0093.309] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="ESD", cAlternateFileName="")) returned 1 [0093.310] GetProcessHeap () returned 0xe70000 [0093.310] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.311] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.311] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0093.311] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.311] GetProcessHeap () returned 0xe70000 [0093.311] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.311] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="Logs", cAlternateFileName="")) returned 1 [0093.312] GetProcessHeap () returned 0xe70000 [0093.312] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.542] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.543] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0093.543] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0093.543] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0093.544] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0093.544] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0093.544] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0093.545] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0093.545] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0093.545] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0093.545] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0093.546] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0093.546] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0093.546] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0093.546] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0093.547] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0093.547] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0093.547] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0093.548] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0093.548] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0093.548] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0093.548] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0093.551] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0093.551] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0093.551] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0093.551] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0093.552] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0093.552] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0093.553] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0093.553] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0093.555] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0093.555] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0093.555] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0093.555] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0093.556] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0093.556] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0093.557] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0093.557] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0093.557] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0093.557] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0093.558] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0093.558] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0093.558] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0093.559] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0093.559] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0093.559] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0093.559] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0093.560] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0093.560] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0093.560] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0093.560] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0093.561] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0093.561] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0093.561] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0093.561] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0093.562] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0093.563] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0093.563] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0093.563] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0093.563] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0093.564] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0093.564] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0093.564] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0093.565] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0093.565] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0093.565] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0093.567] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0093.567] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0093.567] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0093.567] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0093.568] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0093.568] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0093.568] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0093.568] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0093.569] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0093.569] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0093.570] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0093.570] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0093.570] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0093.570] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0093.571] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0093.571] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0093.571] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0093.571] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.582] GetProcessHeap () returned 0xe70000 [0093.582] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.582] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0093.582] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0093.582] GetProcessHeap () returned 0xe70000 [0093.582] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0093.584] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.584] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0093.584] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0093.604] GetProcessHeap () returned 0xe70000 [0093.604] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.604] FindNextFileW (in: hFindFile=0xe893c0, lpFindFileData=0x2dbf818 | out: lpFindFileData=0x2dbf818*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x244b0cf6, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x244b0cf6, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0093.605] GetProcessHeap () returned 0xe70000 [0093.605] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x244b0cf6, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x244b0cf6, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0093.605] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x244b0cf6, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x244b0cf6, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.605] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x2dbf588 | out: lpFindFileData=0x2dbf588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ca5723d, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1ca5723d, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0093.605] GetProcessHeap () returned 0xe70000 [0093.606] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38f0878 [0093.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ca5723d, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1ca5723d, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0093.607] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ca5723d, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1ca5723d, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.607] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x162154a0, ftCreationTime.dwHighDateTime=0x1d579f1, ftLastAccessTime.dwLowDateTime=0x8d97720, ftLastAccessTime.dwHighDateTime=0x1d594a2, ftLastWriteTime.dwLowDateTime=0x8d97720, ftLastWriteTime.dwHighDateTime=0x1d594a2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="brush_spirit.exe", cAlternateFileName="BRUSH_~1.EXE")) returned 1 [0093.607] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0093.607] GetProcessHeap () returned 0xe70000 [0093.608] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0093.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0093.611] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.611] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0093.611] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0093.611] FindClose (in: hFindFile=0xe894c0 | out: hFindFile=0xe894c0) returned 1 [0093.612] GetProcessHeap () returned 0xe70000 [0093.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0093.612] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x2dbf2f8 | out: lpFindFileData=0x2dbf2f8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0093.612] GetProcessHeap () returned 0xe70000 [0093.612] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0093.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0093.629] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.646] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0093.646] GetProcessHeap () returned 0xe70000 [0093.646] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0093.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0093.648] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.652] GetProcessHeap () returned 0xe70000 [0093.652] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0093.652] GetProcessHeap () returned 0xe70000 [0093.652] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0093.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0093.977] GetProcessHeap () returned 0xe70000 [0093.977] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.980] GetProcessHeap () returned 0xe70000 [0093.980] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.981] GetProcessHeap () returned 0xe70000 [0093.981] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.981] GetProcessHeap () returned 0xe70000 [0093.981] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.981] GetProcessHeap () returned 0xe70000 [0093.981] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.982] GetProcessHeap () returned 0xe70000 [0093.982] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.982] GetProcessHeap () returned 0xe70000 [0093.982] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.982] GetProcessHeap () returned 0xe70000 [0093.982] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.982] GetProcessHeap () returned 0xe70000 [0093.982] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.984] GetProcessHeap () returned 0xe70000 [0093.984] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.984] GetProcessHeap () returned 0xe70000 [0093.984] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.984] GetProcessHeap () returned 0xe70000 [0093.984] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.985] GetProcessHeap () returned 0xe70000 [0093.985] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0093.985] GetProcessHeap () returned 0xe70000 [0093.985] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.985] GetProcessHeap () returned 0xe70000 [0093.985] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.992] GetProcessHeap () returned 0xe70000 [0093.992] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.992] GetProcessHeap () returned 0xe70000 [0093.992] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.994] GetProcessHeap () returned 0xe70000 [0093.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.994] GetProcessHeap () returned 0xe70000 [0093.994] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.994] GetProcessHeap () returned 0xe70000 [0093.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.995] GetProcessHeap () returned 0xe70000 [0093.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.995] GetProcessHeap () returned 0xe70000 [0093.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.995] GetProcessHeap () returned 0xe70000 [0093.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.996] GetProcessHeap () returned 0xe70000 [0093.996] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0093.996] GetProcessHeap () returned 0xe70000 [0093.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0093.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.000] GetProcessHeap () returned 0xe70000 [0094.000] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.000] GetProcessHeap () returned 0xe70000 [0094.000] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.001] GetProcessHeap () returned 0xe70000 [0094.001] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.001] GetProcessHeap () returned 0xe70000 [0094.001] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.005] GetProcessHeap () returned 0xe70000 [0094.005] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.006] GetProcessHeap () returned 0xe70000 [0094.007] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.007] GetProcessHeap () returned 0xe70000 [0094.007] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.008] GetProcessHeap () returned 0xe70000 [0094.008] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.008] GetProcessHeap () returned 0xe70000 [0094.008] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.009] GetProcessHeap () returned 0xe70000 [0094.009] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.009] GetProcessHeap () returned 0xe70000 [0094.009] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.015] GetProcessHeap () returned 0xe70000 [0094.015] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.015] GetProcessHeap () returned 0xe70000 [0094.015] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.015] GetProcessHeap () returned 0xe70000 [0094.015] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.015] GetProcessHeap () returned 0xe70000 [0094.015] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.017] GetProcessHeap () returned 0xe70000 [0094.017] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.017] GetProcessHeap () returned 0xe70000 [0094.017] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.017] GetProcessHeap () returned 0xe70000 [0094.018] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.018] GetProcessHeap () returned 0xe70000 [0094.018] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.018] GetProcessHeap () returned 0xe70000 [0094.018] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.018] GetProcessHeap () returned 0xe70000 [0094.018] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.409] GetProcessHeap () returned 0xe70000 [0094.410] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.410] GetProcessHeap () returned 0xe70000 [0094.410] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0094.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.410] GetProcessHeap () returned 0xe70000 [0094.410] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0094.411] GetProcessHeap () returned 0xe70000 [0094.411] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.413] GetProcessHeap () returned 0xe70000 [0094.413] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.414] GetProcessHeap () returned 0xe70000 [0094.414] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.414] GetProcessHeap () returned 0xe70000 [0094.414] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.415] GetProcessHeap () returned 0xe70000 [0094.415] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.415] GetProcessHeap () returned 0xe70000 [0094.415] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.415] GetProcessHeap () returned 0xe70000 [0094.415] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.415] GetProcessHeap () returned 0xe70000 [0094.415] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.416] GetProcessHeap () returned 0xe70000 [0094.416] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.416] GetProcessHeap () returned 0xe70000 [0094.416] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.766] GetProcessHeap () returned 0xe70000 [0094.766] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.766] GetProcessHeap () returned 0xe70000 [0094.766] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.767] GetProcessHeap () returned 0xe70000 [0094.767] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.767] GetProcessHeap () returned 0xe70000 [0094.767] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.767] GetProcessHeap () returned 0xe70000 [0094.767] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.767] GetProcessHeap () returned 0xe70000 [0094.768] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.769] GetProcessHeap () returned 0xe70000 [0094.769] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.770] GetProcessHeap () returned 0xe70000 [0094.770] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.770] GetProcessHeap () returned 0xe70000 [0094.770] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.770] GetProcessHeap () returned 0xe70000 [0094.770] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.771] GetProcessHeap () returned 0xe70000 [0094.771] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.771] GetProcessHeap () returned 0xe70000 [0094.771] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.771] GetProcessHeap () returned 0xe70000 [0094.771] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.772] GetProcessHeap () returned 0xe70000 [0094.772] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.773] GetProcessHeap () returned 0xe70000 [0094.773] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.773] GetProcessHeap () returned 0xe70000 [0094.773] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.773] GetProcessHeap () returned 0xe70000 [0094.774] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.774] GetProcessHeap () returned 0xe70000 [0094.774] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.774] GetProcessHeap () returned 0xe70000 [0094.774] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.774] GetProcessHeap () returned 0xe70000 [0094.774] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.775] GetProcessHeap () returned 0xe70000 [0094.775] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.775] GetProcessHeap () returned 0xe70000 [0094.775] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.777] GetProcessHeap () returned 0xe70000 [0094.777] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.777] GetProcessHeap () returned 0xe70000 [0094.777] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.777] GetProcessHeap () returned 0xe70000 [0094.777] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.777] GetProcessHeap () returned 0xe70000 [0094.777] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.778] GetProcessHeap () returned 0xe70000 [0094.778] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.778] GetProcessHeap () returned 0xe70000 [0094.778] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.778] GetProcessHeap () returned 0xe70000 [0094.779] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.779] GetProcessHeap () returned 0xe70000 [0094.779] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.780] GetProcessHeap () returned 0xe70000 [0094.780] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.781] GetProcessHeap () returned 0xe70000 [0094.781] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.781] GetProcessHeap () returned 0xe70000 [0094.781] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.781] GetProcessHeap () returned 0xe70000 [0094.781] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.782] GetProcessHeap () returned 0xe70000 [0094.782] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.782] GetProcessHeap () returned 0xe70000 [0094.782] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.782] GetProcessHeap () returned 0xe70000 [0094.782] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.782] GetProcessHeap () returned 0xe70000 [0094.783] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.784] GetProcessHeap () returned 0xe70000 [0094.784] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.784] GetProcessHeap () returned 0xe70000 [0094.784] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.785] GetProcessHeap () returned 0xe70000 [0094.785] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.785] GetProcessHeap () returned 0xe70000 [0094.785] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.786] GetProcessHeap () returned 0xe70000 [0094.786] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.786] GetProcessHeap () returned 0xe70000 [0094.786] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0094.790] GetProcessHeap () returned 0xe70000 [0094.790] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0094.791] GetProcessHeap () returned 0xe70000 [0094.791] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0094.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.794] GetProcessHeap () returned 0xe70000 [0094.794] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0094.860] GetProcessHeap () returned 0xe70000 [0094.860] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.863] GetProcessHeap () returned 0xe70000 [0094.863] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0094.866] GetProcessHeap () returned 0xe70000 [0094.866] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0094.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0095.860] GetProcessHeap () returned 0xe70000 [0095.860] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0095.862] GetProcessHeap () returned 0xe70000 [0095.862] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0095.865] GetProcessHeap () returned 0xe70000 [0095.865] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0095.869] GetProcessHeap () returned 0xe70000 [0095.869] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.869] GetProcessHeap () returned 0xe70000 [0095.869] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0095.914] GetProcessHeap () returned 0xe70000 [0095.914] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.914] GetProcessHeap () returned 0xe70000 [0095.915] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0105.239] GetProcessHeap () returned 0xe70000 [0105.239] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0105.240] GetProcessHeap () returned 0xe70000 [0105.240] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0105.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0105.240] GetProcessHeap () returned 0xe70000 [0105.240] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39708b8 [0105.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03b8 [0105.242] GetProcessHeap () returned 0xe70000 [0105.242] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39708b8 | out: hHeap=0xe70000) returned 1 [0105.242] GetProcessHeap () returned 0xe70000 [0105.242] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0105.242] GetProcessHeap () returned 0xe70000 [0105.242] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0105.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0105.243] GetProcessHeap () returned 0xe70000 [0105.243] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39708b8 [0105.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0578 [0105.243] GetProcessHeap () returned 0xe70000 [0105.243] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39708b8 | out: hHeap=0xe70000) returned 1 [0105.243] GetProcessHeap () returned 0xe70000 [0105.243] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0105.243] GetProcessHeap () returned 0xe70000 [0105.243] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0105.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0106.385] GetProcessHeap () returned 0xe70000 [0106.385] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0106.385] GetProcessHeap () returned 0xe70000 [0106.385] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0106.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0106.689] GetProcessHeap () returned 0xe70000 [0106.689] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0106.690] GetProcessHeap () returned 0xe70000 [0106.690] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0106.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03b8 [0106.690] GetProcessHeap () returned 0xe70000 [0106.690] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39708b8 [0106.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0106.691] GetProcessHeap () returned 0xe70000 [0106.691] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0106.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2dbe8b8 | out: lpFindFileData=0x2dbe8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04f8 [0108.812] GetProcessHeap () returned 0xe70000 [0108.812] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.558] GetProcessHeap () returned 0xe70000 [0109.558] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39708b8 | out: hHeap=0xe70000) returned 1 [0110.244] GetProcessHeap () returned 0xe70000 [0110.244] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0110.244] GetProcessHeap () returned 0xe70000 [0110.244] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0110.247] GetProcessHeap () returned 0xe70000 [0110.247] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0110.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0278 [0110.283] GetProcessHeap () returned 0xe70000 [0110.283] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf034b0 | out: hHeap=0xe70000) returned 1 [0110.315] GetProcessHeap () returned 0xe70000 [0110.315] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf034b0 [0110.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2dbf068 | out: lpFindFileData=0x2dbf068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe78 [0110.317] GetProcessHeap () returned 0xe70000 [0110.317] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0110.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03b8 [0110.783] ResetEvent (hEvent=0x2b0) returned 1 [0110.783] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0110.788] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.788] GetProcessHeap () returned 0xe70000 [0110.788] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0110.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0110.793] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.793] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0110.797] ResetEvent (hEvent=0x2b0) returned 1 [0110.797] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0110.858] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x2dbeb48 | out: lpFindFileData=0x2dbeb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0110.859] FindClose (in: hFindFile=0xef0138 | out: hFindFile=0xef0138) returned 1 [0110.859] GetProcessHeap () returned 0xe70000 [0110.859] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0110.859] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0110.859] ResetEvent (hEvent=0x2b0) returned 1 [0110.859] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0111.390] ResetEvent (hEvent=0x2b0) returned 1 [0111.390] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0111.421] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0111.422] ResetEvent (hEvent=0x2b0) returned 1 [0111.422] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0111.459] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0111.459] ResetEvent (hEvent=0x2b0) returned 1 [0111.459] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0111.486] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0111.486] ResetEvent (hEvent=0x2b0) returned 1 [0111.486] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0111.513] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0111.513] ResetEvent (hEvent=0x2b0) returned 1 [0111.513] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0111.550] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0111.551] ResetEvent (hEvent=0x2b0) returned 1 [0111.551] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0112.425] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0112.425] ResetEvent (hEvent=0x2b0) returned 1 [0112.426] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0112.685] ResetEvent (hEvent=0x2b0) returned 1 [0112.685] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0112.725] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0112.725] ResetEvent (hEvent=0x2b0) returned 1 [0112.726] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) returned 0x0 [0113.188] FindNextFileW (in: hFindFile=0xef03b8, lpFindFileData=0x2dbedd8 | out: lpFindFileData=0x2dbedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0113.188] ResetEvent (hEvent=0x2b0) returned 1 [0113.189] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0xffffffff) Thread: id = 19 os_tid = 0x498 [0090.360] GetProcessHeap () returned 0xe70000 [0090.360] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x38) returned 0xe89300 [0090.360] GetProcessHeap () returned 0xe70000 [0090.360] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x18) returned 0xe880c0 [0090.360] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0090.361] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0090.361] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0090.361] GetProcessHeap () returned 0xe70000 [0090.361] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xeafda8 [0090.364] GetProcessHeap () returned 0xe70000 [0090.364] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe98d90 [0090.365] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0090.365] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0090.365] Wow64DisableWow64FsRedirection (in: OldValue=0x327fa44 | out: OldValue=0x327fa44*=0x0) returned 1 [0090.366] GetProcessHeap () returned 0xe70000 [0090.366] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98d90 | out: hHeap=0xe70000) returned 1 [0090.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xd48ba, lpParameter=0x327fa48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0090.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xd48ba, lpParameter=0x327fa48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0090.371] GetProcessHeap () returned 0xe70000 [0090.371] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xebfdb0 [0090.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xe895c0 [0090.373] GetProcessHeap () returned 0xe70000 [0090.373] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xecfdb8 [0090.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0090.379] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0090.379] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Logs", cAlternateFileName="")) returned 1 [0090.379] GetProcessHeap () returned 0xe70000 [0090.379] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xee0dc8 [0090.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0090.396] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.398] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0090.398] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0090.398] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0090.399] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0090.399] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0090.401] GetProcessHeap () returned 0xe70000 [0090.401] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xee0dc8 | out: hHeap=0xe70000) returned 1 [0090.402] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0090.402] GetProcessHeap () returned 0xe70000 [0090.403] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xee0dc8 [0090.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0090.642] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.942] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0090.942] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0090.942] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0090.942] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0090.942] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0090.943] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0090.943] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0090.943] GetProcessHeap () returned 0xe70000 [0090.943] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xee0dc8 | out: hHeap=0xe70000) returned 1 [0090.943] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0090.943] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0090.943] GetProcessHeap () returned 0xe70000 [0090.943] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xecfdb8 | out: hHeap=0xe70000) returned 1 [0090.945] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0090.949] GetProcessHeap () returned 0xe70000 [0090.949] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0090.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0090.949] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0090.950] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0090.950] GetProcessHeap () returned 0xe70000 [0090.950] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.952] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.952] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.952] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.952] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0090.952] GetProcessHeap () returned 0xe70000 [0090.952] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.952] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0090.953] GetProcessHeap () returned 0xe70000 [0090.953] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.953] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.954] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.954] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.954] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0090.954] GetProcessHeap () returned 0xe70000 [0090.954] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.954] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0090.954] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0090.954] GetProcessHeap () returned 0xe70000 [0090.954] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0090.956] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0090.956] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0090.957] GetProcessHeap () returned 0xe70000 [0090.957] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0090.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0090.961] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0090.962] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1025", cAlternateFileName="")) returned 1 [0090.962] GetProcessHeap () returned 0xe70000 [0090.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.964] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.965] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.965] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.965] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.965] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0090.966] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0090.966] GetProcessHeap () returned 0xe70000 [0090.966] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.966] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1028", cAlternateFileName="")) returned 1 [0090.966] GetProcessHeap () returned 0xe70000 [0090.966] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.968] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.968] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.968] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.969] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.969] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0090.969] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0090.969] GetProcessHeap () returned 0xe70000 [0090.969] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.970] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1029", cAlternateFileName="")) returned 1 [0090.970] GetProcessHeap () returned 0xe70000 [0090.970] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0090.971] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.974] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.974] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.974] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.974] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0090.974] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0090.974] GetProcessHeap () returned 0xe70000 [0090.975] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.975] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1030", cAlternateFileName="")) returned 1 [0090.975] GetProcessHeap () returned 0xe70000 [0090.975] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0090.976] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.976] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.977] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.977] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.977] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0090.977] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0090.977] GetProcessHeap () returned 0xe70000 [0090.977] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.977] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1031", cAlternateFileName="")) returned 1 [0090.977] GetProcessHeap () returned 0xe70000 [0090.978] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.979] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.979] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.980] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.980] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.980] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0090.980] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0090.981] GetProcessHeap () returned 0xe70000 [0090.981] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.981] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1032", cAlternateFileName="")) returned 1 [0090.981] GetProcessHeap () returned 0xe70000 [0090.981] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0090.982] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.982] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.983] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.983] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.983] FindNextFileW (in: hFindFile=0xe89800, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0090.983] FindClose (in: hFindFile=0xe89800 | out: hFindFile=0xe89800) returned 1 [0090.983] GetProcessHeap () returned 0xe70000 [0090.983] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0090.983] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1033", cAlternateFileName="")) returned 1 [0090.984] GetProcessHeap () returned 0xe70000 [0090.984] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0090.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.034] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.034] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.035] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.035] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.035] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.035] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.035] GetProcessHeap () returned 0xe70000 [0091.035] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.036] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1035", cAlternateFileName="")) returned 1 [0091.036] GetProcessHeap () returned 0xe70000 [0091.036] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0091.036] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.036] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.037] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.037] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.037] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.037] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0091.037] GetProcessHeap () returned 0xe70000 [0091.037] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.037] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1036", cAlternateFileName="")) returned 1 [0091.037] GetProcessHeap () returned 0xe70000 [0091.037] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.038] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.038] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.038] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.038] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.038] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.038] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.039] GetProcessHeap () returned 0xe70000 [0091.039] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.039] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1037", cAlternateFileName="")) returned 1 [0091.039] GetProcessHeap () returned 0xe70000 [0091.039] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.039] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.040] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.040] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.040] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.040] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.040] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.041] GetProcessHeap () returned 0xe70000 [0091.041] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.041] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1038", cAlternateFileName="")) returned 1 [0091.041] GetProcessHeap () returned 0xe70000 [0091.041] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.042] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.042] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.042] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.042] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.043] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.043] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.043] GetProcessHeap () returned 0xe70000 [0091.043] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.043] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1040", cAlternateFileName="")) returned 1 [0091.043] GetProcessHeap () returned 0xe70000 [0091.043] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.044] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.044] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.044] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.045] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.045] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.045] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.045] GetProcessHeap () returned 0xe70000 [0091.045] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.045] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1041", cAlternateFileName="")) returned 1 [0091.045] GetProcessHeap () returned 0xe70000 [0091.045] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.046] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.046] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.046] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.046] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.046] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.047] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.047] GetProcessHeap () returned 0xe70000 [0091.047] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.047] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1042", cAlternateFileName="")) returned 1 [0091.047] GetProcessHeap () returned 0xe70000 [0091.047] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.048] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.048] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.048] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.048] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.048] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.049] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.049] GetProcessHeap () returned 0xe70000 [0091.049] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.049] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1043", cAlternateFileName="")) returned 1 [0091.049] GetProcessHeap () returned 0xe70000 [0091.049] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0091.049] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.050] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.050] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.051] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.051] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.051] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0091.051] GetProcessHeap () returned 0xe70000 [0091.051] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.051] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1044", cAlternateFileName="")) returned 1 [0091.051] GetProcessHeap () returned 0xe70000 [0091.052] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.250] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.250] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.251] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.251] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.251] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.251] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.251] GetProcessHeap () returned 0xe70000 [0091.251] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.252] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1045", cAlternateFileName="")) returned 1 [0091.252] GetProcessHeap () returned 0xe70000 [0091.252] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.258] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.258] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.259] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.259] GetProcessHeap () returned 0xe70000 [0091.259] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1046", cAlternateFileName="")) returned 1 [0091.259] GetProcessHeap () returned 0xe70000 [0091.259] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.261] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.261] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.261] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.261] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.261] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.261] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.262] GetProcessHeap () returned 0xe70000 [0091.262] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.262] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1049", cAlternateFileName="")) returned 1 [0091.262] GetProcessHeap () returned 0xe70000 [0091.262] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.263] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.263] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.263] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.263] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.263] GetProcessHeap () returned 0xe70000 [0091.263] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.263] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1053", cAlternateFileName="")) returned 1 [0091.263] GetProcessHeap () returned 0xe70000 [0091.264] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.265] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.265] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.265] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.265] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.265] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.265] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.266] GetProcessHeap () returned 0xe70000 [0091.266] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.266] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="1055", cAlternateFileName="")) returned 1 [0091.266] GetProcessHeap () returned 0xe70000 [0091.266] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.267] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.267] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.268] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.268] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.268] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.268] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.268] GetProcessHeap () returned 0xe70000 [0091.268] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.268] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="2052", cAlternateFileName="")) returned 1 [0091.268] GetProcessHeap () returned 0xe70000 [0091.268] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.270] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.270] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.271] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.271] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.271] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.271] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.271] GetProcessHeap () returned 0xe70000 [0091.271] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.271] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="2070", cAlternateFileName="")) returned 1 [0091.271] GetProcessHeap () returned 0xe70000 [0091.271] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.272] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.272] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.272] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.272] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.273] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.273] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.273] GetProcessHeap () returned 0xe70000 [0091.273] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.273] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="3076", cAlternateFileName="")) returned 1 [0091.273] GetProcessHeap () returned 0xe70000 [0091.273] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0091.274] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.274] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.274] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.274] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.274] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.274] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0091.275] GetProcessHeap () returned 0xe70000 [0091.275] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.275] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="3082", cAlternateFileName="")) returned 1 [0091.275] GetProcessHeap () returned 0xe70000 [0091.275] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0091.277] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.277] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.277] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.277] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.277] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0091.277] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0091.277] GetProcessHeap () returned 0xe70000 [0091.278] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.278] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Client", cAlternateFileName="")) returned 1 [0091.278] GetProcessHeap () returned 0xe70000 [0091.278] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0091.279] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.279] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0091.279] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0091.279] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0091.280] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.280] GetProcessHeap () returned 0xe70000 [0091.280] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.280] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0091.280] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0091.280] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Extended", cAlternateFileName="")) returned 1 [0091.280] GetProcessHeap () returned 0xe70000 [0091.280] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.281] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.281] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0091.281] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0091.281] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0091.281] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.282] GetProcessHeap () returned 0xe70000 [0091.282] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.282] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Graphics", cAlternateFileName="")) returned 1 [0091.282] GetProcessHeap () returned 0xe70000 [0091.282] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0091.286] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.287] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0091.287] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0091.287] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0091.287] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0091.287] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0091.287] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0091.288] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0091.288] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0091.288] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0091.288] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0091.288] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0091.288] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0091.289] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0091.289] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0091.289] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0091.289] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0091.289] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0091.291] GetProcessHeap () returned 0xe70000 [0091.291] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0091.291] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0091.291] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0091.291] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0091.292] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0091.292] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0091.292] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0091.292] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0091.293] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0091.293] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0091.293] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0091.294] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0091.294] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0091.294] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0091.294] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0091.294] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0091.294] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0091.295] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0091.296] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0091.296] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0091.296] FindClose (in: hFindFile=0xe897c0 | out: hFindFile=0xe897c0) returned 1 [0091.296] GetProcessHeap () returned 0xe70000 [0091.296] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.296] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="Boot", cAlternateFileName="")) returned 1 [0091.296] GetProcessHeap () returned 0xe70000 [0091.296] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0091.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0091.299] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0091.717] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="BCD", cAlternateFileName="")) returned 1 [0091.717] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0091.717] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0091.718] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0091.718] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0091.718] GetProcessHeap () returned 0xe70000 [0091.718] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.719] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.719] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.719] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0091.719] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.719] GetProcessHeap () returned 0xe70000 [0091.719] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.720] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0091.720] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0091.720] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0091.720] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0091.720] GetProcessHeap () returned 0xe70000 [0091.720] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.722] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.722] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.722] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.722] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.723] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.723] GetProcessHeap () returned 0xe70000 [0091.723] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.723] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="da-DK", cAlternateFileName="")) returned 1 [0091.723] GetProcessHeap () returned 0xe70000 [0091.723] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.724] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.724] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.725] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.725] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.725] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.725] GetProcessHeap () returned 0xe70000 [0091.725] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.725] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="de-DE", cAlternateFileName="")) returned 1 [0091.725] GetProcessHeap () returned 0xe70000 [0091.725] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.726] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.726] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.726] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.726] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.726] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.726] GetProcessHeap () returned 0xe70000 [0091.727] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.727] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="el-GR", cAlternateFileName="")) returned 1 [0091.727] GetProcessHeap () returned 0xe70000 [0091.727] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0091.728] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.728] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.728] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.728] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.729] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0091.729] GetProcessHeap () returned 0xe70000 [0091.729] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.729] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="en-GB", cAlternateFileName="")) returned 1 [0091.729] GetProcessHeap () returned 0xe70000 [0091.729] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0091.730] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.730] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.731] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0091.731] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0091.731] GetProcessHeap () returned 0xe70000 [0091.731] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.731] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="en-US", cAlternateFileName="")) returned 1 [0091.731] GetProcessHeap () returned 0xe70000 [0091.731] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0091.731] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.732] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.732] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.732] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.732] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0091.732] GetProcessHeap () returned 0xe70000 [0091.732] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.732] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="es-ES", cAlternateFileName="")) returned 1 [0091.732] GetProcessHeap () returned 0xe70000 [0091.733] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.734] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.734] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.734] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.734] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.734] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.734] GetProcessHeap () returned 0xe70000 [0091.735] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.735] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="es-MX", cAlternateFileName="")) returned 1 [0091.735] GetProcessHeap () returned 0xe70000 [0091.735] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.736] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.736] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.736] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0091.737] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.737] GetProcessHeap () returned 0xe70000 [0091.737] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.737] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="et-EE", cAlternateFileName="")) returned 1 [0091.737] GetProcessHeap () returned 0xe70000 [0091.737] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.738] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.739] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.739] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0091.739] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.739] GetProcessHeap () returned 0xe70000 [0091.739] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.739] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0091.739] GetProcessHeap () returned 0xe70000 [0091.739] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.741] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.741] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.742] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.742] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.742] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.742] GetProcessHeap () returned 0xe70000 [0091.742] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.742] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Fonts", cAlternateFileName="")) returned 1 [0091.742] GetProcessHeap () returned 0xe70000 [0091.742] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0091.747] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.747] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0091.747] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0091.748] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0091.748] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0091.748] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0091.748] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0091.748] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0091.748] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0091.749] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0091.749] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0091.749] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0091.749] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0091.749] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0091.749] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0091.750] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0091.750] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0091.750] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0091.750] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0091.752] GetProcessHeap () returned 0xe70000 [0091.752] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.752] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0091.752] GetProcessHeap () returned 0xe70000 [0091.752] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0091.754] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.754] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.754] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0091.754] FindClose (in: hFindFile=0xe89340 | out: hFindFile=0xe89340) returned 1 [0091.754] GetProcessHeap () returned 0xe70000 [0091.754] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.754] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0091.755] GetProcessHeap () returned 0xe70000 [0091.755] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0091.755] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.755] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.755] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.755] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.756] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0091.756] GetProcessHeap () returned 0xe70000 [0091.756] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0091.756] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0091.756] GetProcessHeap () returned 0xe70000 [0091.756] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0091.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.238] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.238] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.238] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.238] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.238] GetProcessHeap () returned 0xe70000 [0092.239] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.239] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0092.239] GetProcessHeap () returned 0xe70000 [0092.239] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.239] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.240] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.240] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.240] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.240] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.240] GetProcessHeap () returned 0xe70000 [0092.240] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.240] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="it-IT", cAlternateFileName="")) returned 1 [0092.241] GetProcessHeap () returned 0xe70000 [0092.241] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.242] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.242] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.242] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.243] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.243] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.243] GetProcessHeap () returned 0xe70000 [0092.243] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.243] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0092.243] GetProcessHeap () returned 0xe70000 [0092.243] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.245] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.245] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.245] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.245] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.245] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.245] GetProcessHeap () returned 0xe70000 [0092.245] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.246] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0092.246] GetProcessHeap () returned 0xe70000 [0092.246] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.247] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.247] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.247] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.248] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.248] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.248] GetProcessHeap () returned 0xe70000 [0092.248] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.248] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0092.248] GetProcessHeap () returned 0xe70000 [0092.248] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.249] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.249] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.249] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.249] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.249] GetProcessHeap () returned 0xe70000 [0092.249] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.249] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0092.250] GetProcessHeap () returned 0xe70000 [0092.250] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89480 [0092.251] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.251] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.251] FindNextFileW (in: hFindFile=0xe89480, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.251] FindClose (in: hFindFile=0xe89480 | out: hFindFile=0xe89480) returned 1 [0092.252] GetProcessHeap () returned 0xe70000 [0092.252] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.252] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0092.252] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0092.252] GetProcessHeap () returned 0xe70000 [0092.252] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.255] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.255] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.255] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.255] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.255] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.255] GetProcessHeap () returned 0xe70000 [0092.255] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.256] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0092.256] GetProcessHeap () returned 0xe70000 [0092.256] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.256] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.256] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.257] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.257] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.257] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.257] GetProcessHeap () returned 0xe70000 [0092.257] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.257] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0092.257] GetProcessHeap () returned 0xe70000 [0092.257] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.259] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.259] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.259] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.259] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.260] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.260] GetProcessHeap () returned 0xe70000 [0092.260] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.260] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0092.260] GetProcessHeap () returned 0xe70000 [0092.260] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.262] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.262] GetProcessHeap () returned 0xe70000 [0092.262] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.263] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0092.263] GetProcessHeap () returned 0xe70000 [0092.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.264] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.264] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.264] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.265] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.265] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.265] GetProcessHeap () returned 0xe70000 [0092.265] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.265] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0092.265] GetProcessHeap () returned 0xe70000 [0092.265] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.266] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.266] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.266] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.266] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.266] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.267] GetProcessHeap () returned 0xe70000 [0092.267] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.267] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0092.267] GetProcessHeap () returned 0xe70000 [0092.267] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.269] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.269] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0092.269] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.269] GetProcessHeap () returned 0xe70000 [0092.269] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38f0878 [0092.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89440 [0092.271] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.271] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0092.271] FindNextFileW (in: hFindFile=0xe89440, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0092.271] FindClose (in: hFindFile=0xe89440 | out: hFindFile=0xe89440) returned 1 [0092.272] GetProcessHeap () returned 0xe70000 [0092.272] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38f0878 | out: hHeap=0xe70000) returned 1 [0092.272] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0092.272] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.272] GetProcessHeap () returned 0xe70000 [0092.272] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.274] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0092.274] GetProcessHeap () returned 0xe70000 [0092.274] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0092.276] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.276] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.276] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.276] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0092.276] GetProcessHeap () returned 0xe70000 [0092.277] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.277] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0092.277] GetProcessHeap () returned 0xe70000 [0092.277] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0092.279] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.279] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.279] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.279] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.279] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0092.279] GetProcessHeap () returned 0xe70000 [0092.279] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.279] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0092.280] GetProcessHeap () returned 0xe70000 [0092.280] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.280] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.280] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.280] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.280] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.281] GetProcessHeap () returned 0xe70000 [0092.281] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.281] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0092.281] GetProcessHeap () returned 0xe70000 [0092.281] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.283] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.283] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.283] GetProcessHeap () returned 0xe70000 [0092.283] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0092.284] GetProcessHeap () returned 0xe70000 [0092.284] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0092.889] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.889] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.889] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.889] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.889] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0092.890] GetProcessHeap () returned 0xe70000 [0092.890] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0092.890] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0092.890] GetProcessHeap () returned 0xe70000 [0092.890] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0092.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.251] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.251] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.251] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0093.251] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.251] GetProcessHeap () returned 0xe70000 [0093.252] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.252] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0093.252] GetProcessHeap () returned 0xe70000 [0093.252] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.260] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.261] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.261] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.261] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.261] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.261] GetProcessHeap () returned 0xe70000 [0093.261] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.261] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0093.262] GetProcessHeap () returned 0xe70000 [0093.262] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.262] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.263] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.263] GetProcessHeap () returned 0xe70000 [0093.263] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.263] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0093.263] GetProcessHeap () returned 0xe70000 [0093.263] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89140 [0093.264] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.265] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.265] FindNextFileW (in: hFindFile=0xe89140, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0093.265] FindClose (in: hFindFile=0xe89140 | out: hFindFile=0xe89140) returned 1 [0093.265] GetProcessHeap () returned 0xe70000 [0093.265] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.265] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0093.265] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0093.265] GetProcessHeap () returned 0xe70000 [0093.266] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.267] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.267] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.267] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.268] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.268] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.268] GetProcessHeap () returned 0xe70000 [0093.268] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.268] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0093.268] GetProcessHeap () returned 0xe70000 [0093.268] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.269] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.269] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.269] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.269] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.269] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.269] GetProcessHeap () returned 0xe70000 [0093.270] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.270] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0093.270] GetProcessHeap () returned 0xe70000 [0093.270] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xedfdc0 [0093.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.271] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.271] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.271] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.272] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.272] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.272] GetProcessHeap () returned 0xe70000 [0093.272] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xedfdc0 | out: hHeap=0xe70000) returned 1 [0093.272] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0093.272] FindClose (in: hFindFile=0xe894c0 | out: hFindFile=0xe894c0) returned 1 [0093.272] GetProcessHeap () returned 0xe70000 [0093.272] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0093.273] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0093.274] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0093.274] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1e98d9d, dwReserved1=0x745f9fc4, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0093.274] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0093.274] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="ESD", cAlternateFileName="")) returned 1 [0093.274] GetProcessHeap () returned 0xe70000 [0093.274] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0093.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.280] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.280] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0093.280] FindClose (in: hFindFile=0xe89780 | out: hFindFile=0xe89780) returned 1 [0093.280] GetProcessHeap () returned 0xe70000 [0093.281] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0093.281] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0093.281] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="Logs", cAlternateFileName="")) returned 1 [0093.281] GetProcessHeap () returned 0xe70000 [0093.281] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0093.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.292] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.531] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0093.531] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0093.531] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0093.531] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0093.532] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0093.532] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0093.532] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0093.532] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0093.532] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0093.532] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0093.533] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0093.533] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0093.533] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0093.533] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0093.533] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0093.533] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0093.534] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0093.534] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0093.534] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0093.534] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0093.535] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0093.572] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0093.572] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0093.573] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0093.573] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0093.573] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0093.573] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0093.573] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0093.573] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0093.574] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0093.574] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0093.574] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0093.574] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0093.574] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0093.574] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0093.575] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0093.575] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0093.575] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0093.575] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0093.575] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0093.575] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0093.578] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0093.578] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0093.578] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0093.578] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0093.578] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0093.578] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0093.579] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0093.579] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0093.579] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0093.579] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0093.579] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0093.579] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0093.580] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0093.580] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0093.580] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0093.580] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0093.580] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0093.580] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0093.581] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0093.581] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0093.581] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0093.614] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0093.614] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0093.614] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0093.614] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0093.614] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0093.614] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0093.615] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0093.615] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0093.615] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0093.615] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0093.615] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0093.615] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0093.616] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0093.616] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0093.616] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0093.616] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0093.616] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0093.616] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0093.617] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0093.617] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0093.617] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0093.617] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0093.617] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0093.618] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0093.618] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0093.618] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0093.618] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0093.618] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.621] GetProcessHeap () returned 0xe70000 [0093.621] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0093.621] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0093.621] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0093.621] GetProcessHeap () returned 0xe70000 [0093.621] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0093.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.622] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.622] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0093.622] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.622] GetProcessHeap () returned 0xe70000 [0093.622] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x38d0868 | out: hHeap=0xe70000) returned 1 [0093.622] FindNextFileW (in: hFindFile=0xe895c0, lpFindFileData=0x327f7b8 | out: lpFindFileData=0x327f7b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x244b0cf6, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x244b0cf6, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x745f9fc4, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0093.622] GetProcessHeap () returned 0xe70000 [0093.622] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38d0868 [0093.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x244b0cf6, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x244b0cf6, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0xe89780 [0093.623] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x244b0cf6, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x244b0cf6, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0093.623] FindNextFileW (in: hFindFile=0xe89780, lpFindFileData=0x327f528 | out: lpFindFileData=0x327f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ca5723d, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1ca5723d, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecfdb8, dwReserved1=0x450047, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0093.623] GetProcessHeap () returned 0xe70000 [0093.623] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0093.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ca5723d, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1ca5723d, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0093.623] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ca5723d, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1ca5723d, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.623] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x162154a0, ftCreationTime.dwHighDateTime=0x1d579f1, ftLastAccessTime.dwLowDateTime=0x8d97720, ftLastAccessTime.dwHighDateTime=0x1d594a2, ftLastWriteTime.dwLowDateTime=0x8d97720, ftLastWriteTime.dwHighDateTime=0x1d594a2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="brush_spirit.exe", cAlternateFileName="BRUSH_~1.EXE")) returned 1 [0093.624] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0093.624] GetProcessHeap () returned 0xe70000 [0093.624] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0093.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.625] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.625] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0093.625] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0093.625] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.626] GetProcessHeap () returned 0xe70000 [0093.626] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0093.626] FindNextFileW (in: hFindFile=0xe89340, lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0093.626] GetProcessHeap () returned 0xe70000 [0093.626] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0093.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0093.626] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.627] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0093.627] GetProcessHeap () returned 0xe70000 [0093.627] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0093.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0093.629] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.631] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0093.631] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0093.631] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0093.631] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0093.631] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0093.631] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0093.632] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0093.632] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0093.632] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0093.632] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0093.632] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0093.632] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0093.633] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0093.633] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0093.633] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0093.633] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0093.633] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0093.633] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0093.634] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0093.634] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0093.634] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0093.634] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0093.634] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0093.634] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0093.635] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0093.635] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0093.635] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0093.635] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0093.636] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0093.636] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0093.636] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0093.636] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0093.636] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0093.636] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0093.637] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0093.637] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0093.637] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0093.637] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0093.637] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0093.637] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0093.638] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0093.638] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0093.638] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0093.640] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0093.640] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0093.640] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0093.640] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0093.640] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0093.640] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0093.641] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0093.641] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0093.641] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0093.641] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0093.641] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0093.641] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0093.642] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0093.642] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0093.642] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0093.642] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0093.642] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0093.642] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0093.643] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0093.643] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0093.643] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0093.643] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0093.643] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0093.643] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0093.644] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0093.644] GetProcessHeap () returned 0xe70000 [0093.644] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0093.644] FindNextFileW (in: hFindFile=0xe897c0, lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0093.644] GetProcessHeap () returned 0xe70000 [0093.644] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0093.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.019] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.019] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0094.020] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0094.020] GetProcessHeap () returned 0xe70000 [0094.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.021] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.021] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.021] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.022] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.022] GetProcessHeap () returned 0xe70000 [0094.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.022] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0094.022] GetProcessHeap () returned 0xe70000 [0094.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.022] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.022] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.023] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.023] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.023] GetProcessHeap () returned 0xe70000 [0094.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.023] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0094.023] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0094.023] GetProcessHeap () returned 0xe70000 [0094.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.024] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.024] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.024] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.024] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.024] GetProcessHeap () returned 0xe70000 [0094.024] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.024] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0094.025] GetProcessHeap () returned 0xe70000 [0094.025] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.025] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.025] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.025] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.025] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.025] GetProcessHeap () returned 0xe70000 [0094.025] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.026] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0094.026] GetProcessHeap () returned 0xe70000 [0094.026] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.026] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.026] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.026] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.026] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.027] GetProcessHeap () returned 0xe70000 [0094.027] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.027] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0094.027] GetProcessHeap () returned 0xe70000 [0094.027] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.027] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.028] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.028] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.028] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.028] GetProcessHeap () returned 0xe70000 [0094.028] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.028] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0094.028] GetProcessHeap () returned 0xe70000 [0094.028] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.029] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.029] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.029] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.029] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.029] GetProcessHeap () returned 0xe70000 [0094.029] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.029] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.030] GetProcessHeap () returned 0xe70000 [0094.030] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.032] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.032] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0094.032] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0094.032] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0094.033] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0094.033] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0094.033] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0094.033] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0094.033] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0094.033] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0094.034] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0094.035] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0094.035] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0094.036] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0094.036] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0094.036] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0094.037] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.037] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0094.037] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0094.037] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.039] GetProcessHeap () returned 0xe70000 [0094.039] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.039] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0094.039] GetProcessHeap () returned 0xe70000 [0094.039] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.040] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.040] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.040] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.040] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.040] GetProcessHeap () returned 0xe70000 [0094.040] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.040] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0094.040] GetProcessHeap () returned 0xe70000 [0094.041] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.041] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.041] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.041] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.041] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.041] GetProcessHeap () returned 0xe70000 [0094.041] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.042] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0094.042] GetProcessHeap () returned 0xe70000 [0094.042] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.042] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.042] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.042] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.042] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.043] GetProcessHeap () returned 0xe70000 [0094.043] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.043] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0094.043] GetProcessHeap () returned 0xe70000 [0094.043] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.043] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.043] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.043] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.044] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.044] GetProcessHeap () returned 0xe70000 [0094.044] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.044] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0094.044] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0094.044] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0094.044] GetProcessHeap () returned 0xe70000 [0094.044] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.045] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.045] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.045] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.045] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.045] GetProcessHeap () returned 0xe70000 [0094.045] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.045] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0094.045] GetProcessHeap () returned 0xe70000 [0094.046] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.046] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.046] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.046] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.046] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.046] GetProcessHeap () returned 0xe70000 [0094.046] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.046] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0094.047] GetProcessHeap () returned 0xe70000 [0094.047] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.366] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.366] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0094.366] GetProcessHeap () returned 0xe70000 [0094.366] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04b8 [0094.368] FindNextFileW (in: hFindFile=0xef04b8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.368] FindNextFileW (in: hFindFile=0xef04b8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0094.368] FindNextFileW (in: hFindFile=0xef04b8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0094.369] FindClose (in: hFindFile=0xef04b8 | out: hFindFile=0xef04b8) returned 1 [0094.369] GetProcessHeap () returned 0xe70000 [0094.369] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.369] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0094.369] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0094.369] GetProcessHeap () returned 0xe70000 [0094.369] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef06f8 [0094.370] FindNextFileW (in: hFindFile=0xef06f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.370] FindNextFileW (in: hFindFile=0xef06f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0094.370] FindNextFileW (in: hFindFile=0xef06f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0094.370] FindClose (in: hFindFile=0xef06f8 | out: hFindFile=0xef06f8) returned 1 [0094.370] GetProcessHeap () returned 0xe70000 [0094.370] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.370] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0094.371] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0094.371] GetProcessHeap () returned 0xe70000 [0094.371] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0c38 [0094.371] FindNextFileW (in: hFindFile=0xef0c38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.371] FindNextFileW (in: hFindFile=0xef0c38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0094.371] FindNextFileW (in: hFindFile=0xef0c38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0094.372] FindNextFileW (in: hFindFile=0xef0c38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0094.372] FindNextFileW (in: hFindFile=0xef0c38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0094.372] FindClose (in: hFindFile=0xef0c38 | out: hFindFile=0xef0c38) returned 1 [0094.372] GetProcessHeap () returned 0xe70000 [0094.372] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.372] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0094.372] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0094.372] GetProcessHeap () returned 0xe70000 [0094.372] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0bf8 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0094.375] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0094.376] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0094.376] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0094.376] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0094.376] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0094.376] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0094.376] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0094.377] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0094.377] FindNextFileW (in: hFindFile=0xef0bf8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0094.377] FindClose (in: hFindFile=0xef0bf8 | out: hFindFile=0xef0bf8) returned 1 [0094.380] GetProcessHeap () returned 0xe70000 [0094.380] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.380] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0094.380] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0094.380] GetProcessHeap () returned 0xe70000 [0094.380] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff78 [0094.381] FindNextFileW (in: hFindFile=0xeeff78, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.381] FindNextFileW (in: hFindFile=0xeeff78, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0094.381] FindNextFileW (in: hFindFile=0xeeff78, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0094.381] FindClose (in: hFindFile=0xeeff78 | out: hFindFile=0xeeff78) returned 1 [0094.381] GetProcessHeap () returned 0xe70000 [0094.381] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.381] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0094.381] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0094.382] GetProcessHeap () returned 0xe70000 [0094.382] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0678 [0094.382] FindNextFileW (in: hFindFile=0xef0678, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.382] FindNextFileW (in: hFindFile=0xef0678, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0094.382] FindNextFileW (in: hFindFile=0xef0678, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0094.382] FindClose (in: hFindFile=0xef0678 | out: hFindFile=0xef0678) returned 1 [0094.382] GetProcessHeap () returned 0xe70000 [0094.382] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.383] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0094.383] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1 [0094.383] GetProcessHeap () returned 0xe70000 [0094.383] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0b38 [0094.383] FindNextFileW (in: hFindFile=0xef0b38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.383] FindNextFileW (in: hFindFile=0xef0b38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0094.384] FindNextFileW (in: hFindFile=0xef0b38, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0094.384] FindClose (in: hFindFile=0xef0b38 | out: hFindFile=0xef0b38) returned 1 [0094.384] GetProcessHeap () returned 0xe70000 [0094.384] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.384] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0094.384] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0094.384] GetProcessHeap () returned 0xe70000 [0094.384] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0078 [0094.385] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0094.385] FindClose (in: hFindFile=0xef0078 | out: hFindFile=0xef0078) returned 1 [0094.385] GetProcessHeap () returned 0xe70000 [0094.385] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.385] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0094.386] GetProcessHeap () returned 0xe70000 [0094.386] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0778 [0094.387] FindNextFileW (in: hFindFile=0xef0778, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.387] FindNextFileW (in: hFindFile=0xef0778, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0094.387] FindNextFileW (in: hFindFile=0xef0778, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0094.387] FindClose (in: hFindFile=0xef0778 | out: hFindFile=0xef0778) returned 1 [0094.387] GetProcessHeap () returned 0xe70000 [0094.387] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.387] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0094.387] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0094.388] GetProcessHeap () returned 0xe70000 [0094.388] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0094.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02f8 [0094.389] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.389] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0094.390] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0094.390] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0094.390] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0094.390] FindClose (in: hFindFile=0xef02f8 | out: hFindFile=0xef02f8) returned 1 [0094.390] GetProcessHeap () returned 0xe70000 [0094.390] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0094.390] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0094.390] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0094.391] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.391] GetProcessHeap () returned 0xe70000 [0094.391] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.392] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0094.392] GetProcessHeap () returned 0xe70000 [0094.393] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.395] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.395] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.395] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.395] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.395] GetProcessHeap () returned 0xe70000 [0094.396] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.396] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0094.396] GetProcessHeap () returned 0xe70000 [0094.396] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.396] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.396] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.397] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.398] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.398] GetProcessHeap () returned 0xe70000 [0094.398] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.398] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0094.398] GetProcessHeap () returned 0xe70000 [0094.398] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.399] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.399] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.399] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.399] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.399] GetProcessHeap () returned 0xe70000 [0094.399] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.399] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0094.400] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0094.400] GetProcessHeap () returned 0xe70000 [0094.400] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.400] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.400] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0094.401] FindClose (in: hFindFile=0xe89500 | out: hFindFile=0xe89500) returned 1 [0094.401] GetProcessHeap () returned 0xe70000 [0094.401] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.401] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0094.401] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0094.401] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0094.401] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0094.401] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0094.402] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0094.402] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0094.402] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0094.402] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0094.402] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0094.402] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0094.403] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0094.403] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0094.403] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0094.403] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0094.403] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0094.403] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0094.406] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0094.406] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0094.406] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0094.406] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0094.406] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0094.406] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0094.407] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0094.407] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0094.407] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0094.407] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0094.407] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0094.407] GetProcessHeap () returned 0xe70000 [0094.407] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0094.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.871] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.871] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.871] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.871] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.872] GetProcessHeap () returned 0xe70000 [0094.872] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0094.872] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0094.872] GetProcessHeap () returned 0xe70000 [0094.872] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.872] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.873] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.873] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.873] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.873] GetProcessHeap () returned 0xe70000 [0094.873] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.873] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0094.873] GetProcessHeap () returned 0xe70000 [0094.873] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.874] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.874] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.874] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.874] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.874] GetProcessHeap () returned 0xe70000 [0094.874] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.874] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0094.875] GetProcessHeap () returned 0xe70000 [0094.875] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.875] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.875] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0094.875] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0094.875] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.875] GetProcessHeap () returned 0xe70000 [0094.876] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.876] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0094.876] GetProcessHeap () returned 0xe70000 [0094.876] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.876] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.876] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.876] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.877] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.877] GetProcessHeap () returned 0xe70000 [0094.877] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.877] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0094.877] GetProcessHeap () returned 0xe70000 [0094.877] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.877] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.877] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.878] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.878] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.878] GetProcessHeap () returned 0xe70000 [0094.878] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.878] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0094.878] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0094.879] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0094.879] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0094.879] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0094.879] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0094.879] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0094.879] GetProcessHeap () returned 0xe70000 [0094.879] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.880] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.880] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.880] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.880] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.880] GetProcessHeap () returned 0xe70000 [0094.880] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.880] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0094.880] GetProcessHeap () returned 0xe70000 [0094.880] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.881] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.881] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.881] FindNextFileW (in: hFindFile=0xe89400, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0094.881] FindClose (in: hFindFile=0xe89400 | out: hFindFile=0xe89400) returned 1 [0094.881] GetProcessHeap () returned 0xe70000 [0094.881] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.882] FindNextFileW (in: hFindFile=0xe894c0, lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0094.882] GetProcessHeap () returned 0xe70000 [0094.882] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.882] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.882] FindNextFileW (in: hFindFile=0xe89500, lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.883] GetProcessHeap () returned 0xe70000 [0094.883] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.883] GetProcessHeap () returned 0xe70000 [0094.883] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.883] GetProcessHeap () returned 0xe70000 [0094.883] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.883] GetProcessHeap () returned 0xe70000 [0094.883] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.884] GetProcessHeap () returned 0xe70000 [0094.884] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.884] GetProcessHeap () returned 0xe70000 [0094.884] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.884] GetProcessHeap () returned 0xe70000 [0094.884] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.884] GetProcessHeap () returned 0xe70000 [0094.884] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.885] GetProcessHeap () returned 0xe70000 [0094.885] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.885] GetProcessHeap () returned 0xe70000 [0094.885] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.885] GetProcessHeap () returned 0xe70000 [0094.885] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.885] GetProcessHeap () returned 0xe70000 [0094.886] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.886] GetProcessHeap () returned 0xe70000 [0094.886] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.886] GetProcessHeap () returned 0xe70000 [0094.886] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.886] GetProcessHeap () returned 0xe70000 [0094.886] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.887] GetProcessHeap () returned 0xe70000 [0094.887] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.887] GetProcessHeap () returned 0xe70000 [0094.887] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.887] GetProcessHeap () returned 0xe70000 [0094.887] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.887] GetProcessHeap () returned 0xe70000 [0094.888] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.888] GetProcessHeap () returned 0xe70000 [0094.888] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0094.888] GetProcessHeap () returned 0xe70000 [0094.888] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.888] GetProcessHeap () returned 0xe70000 [0094.888] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.889] GetProcessHeap () returned 0xe70000 [0094.889] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.889] GetProcessHeap () returned 0xe70000 [0094.889] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.889] GetProcessHeap () returned 0xe70000 [0094.889] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.889] GetProcessHeap () returned 0xe70000 [0094.889] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.890] GetProcessHeap () returned 0xe70000 [0094.890] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.890] GetProcessHeap () returned 0xe70000 [0094.890] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0094.892] GetProcessHeap () returned 0xe70000 [0094.892] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0094.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.893] GetProcessHeap () returned 0xe70000 [0094.893] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0094.897] GetProcessHeap () returned 0xe70000 [0094.897] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0094.897] GetProcessHeap () returned 0xe70000 [0094.897] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0094.899] GetProcessHeap () returned 0xe70000 [0094.899] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0094.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0094.900] GetProcessHeap () returned 0xe70000 [0094.900] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0094.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.197] GetProcessHeap () returned 0xe70000 [0095.197] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.198] GetProcessHeap () returned 0xe70000 [0095.198] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.200] GetProcessHeap () returned 0xe70000 [0095.200] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0095.201] GetProcessHeap () returned 0xe70000 [0095.202] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.202] GetProcessHeap () returned 0xe70000 [0095.202] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0095.203] GetProcessHeap () returned 0xe70000 [0095.203] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.203] GetProcessHeap () returned 0xe70000 [0095.203] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.209] GetProcessHeap () returned 0xe70000 [0095.209] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.210] GetProcessHeap () returned 0xe70000 [0095.210] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.210] GetProcessHeap () returned 0xe70000 [0095.210] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0095.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0095.212] GetProcessHeap () returned 0xe70000 [0095.212] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.212] GetProcessHeap () returned 0xe70000 [0095.212] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.212] GetProcessHeap () returned 0xe70000 [0095.212] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.214] GetProcessHeap () returned 0xe70000 [0095.214] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0095.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0095.214] GetProcessHeap () returned 0xe70000 [0095.214] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.215] GetProcessHeap () returned 0xe70000 [0095.215] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.215] GetProcessHeap () returned 0xe70000 [0095.215] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.216] GetProcessHeap () returned 0xe70000 [0095.216] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.216] GetProcessHeap () returned 0xe70000 [0095.216] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.217] GetProcessHeap () returned 0xe70000 [0095.217] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.217] GetProcessHeap () returned 0xe70000 [0095.217] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.218] GetProcessHeap () returned 0xe70000 [0095.218] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0095.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0095.223] GetProcessHeap () returned 0xe70000 [0095.223] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0095.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0095.228] GetProcessHeap () returned 0xe70000 [0095.228] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0095.228] GetProcessHeap () returned 0xe70000 [0095.228] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.230] GetProcessHeap () returned 0xe70000 [0095.230] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.230] GetProcessHeap () returned 0xe70000 [0095.230] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0095.231] GetProcessHeap () returned 0xe70000 [0095.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0095.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0095.233] GetProcessHeap () returned 0xe70000 [0095.233] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0095.233] GetProcessHeap () returned 0xe70000 [0095.233] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0095.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0095.563] GetProcessHeap () returned 0xe70000 [0095.563] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.567] GetProcessHeap () returned 0xe70000 [0095.567] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0095.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0095.569] GetProcessHeap () returned 0xe70000 [0095.569] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.569] GetProcessHeap () returned 0xe70000 [0095.569] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.571] GetProcessHeap () returned 0xe70000 [0095.572] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.573] GetProcessHeap () returned 0xe70000 [0095.573] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.573] GetProcessHeap () returned 0xe70000 [0095.573] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.578] GetProcessHeap () returned 0xe70000 [0095.578] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0095.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0095.580] GetProcessHeap () returned 0xe70000 [0095.580] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.580] GetProcessHeap () returned 0xe70000 [0095.580] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.582] GetProcessHeap () returned 0xe70000 [0095.582] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3910888 [0095.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.586] GetProcessHeap () returned 0xe70000 [0095.586] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0095.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0095.588] GetProcessHeap () returned 0xe70000 [0095.588] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0095.589] GetProcessHeap () returned 0xe70000 [0095.589] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3910888 | out: hHeap=0xe70000) returned 1 [0095.591] GetProcessHeap () returned 0xe70000 [0095.591] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0095.591] GetProcessHeap () returned 0xe70000 [0095.592] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0095.594] GetProcessHeap () returned 0xe70000 [0095.594] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0095.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe897c0 [0095.597] GetProcessHeap () returned 0xe70000 [0095.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0095.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0095.599] GetProcessHeap () returned 0xe70000 [0095.599] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0095.599] GetProcessHeap () returned 0xe70000 [0095.599] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0095.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0095.600] GetProcessHeap () returned 0xe70000 [0095.600] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0095.600] GetProcessHeap () returned 0xe70000 [0095.600] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0095.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0095.600] GetProcessHeap () returned 0xe70000 [0095.600] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0095.601] GetProcessHeap () returned 0xe70000 [0095.601] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0095.602] GetProcessHeap () returned 0xe70000 [0095.602] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0095.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x1cac98be, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x1cac98be, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0095.603] GetProcessHeap () returned 0xe70000 [0095.603] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0095.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0096.321] GetProcessHeap () returned 0xe70000 [0096.321] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0096.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0096.328] GetProcessHeap () returned 0xe70000 [0096.328] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.330] GetProcessHeap () returned 0xe70000 [0096.330] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.332] GetProcessHeap () returned 0xe70000 [0096.332] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.336] GetProcessHeap () returned 0xe70000 [0096.336] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.337] GetProcessHeap () returned 0xe70000 [0096.337] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.338] GetProcessHeap () returned 0xe70000 [0096.338] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.338] GetProcessHeap () returned 0xe70000 [0096.339] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0096.342] GetProcessHeap () returned 0xe70000 [0096.342] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0096.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0096.352] GetProcessHeap () returned 0xe70000 [0096.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.355] GetProcessHeap () returned 0xe70000 [0096.355] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.355] GetProcessHeap () returned 0xe70000 [0096.355] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.357] GetProcessHeap () returned 0xe70000 [0096.357] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.357] GetProcessHeap () returned 0xe70000 [0096.357] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.358] GetProcessHeap () returned 0xe70000 [0096.358] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.358] GetProcessHeap () returned 0xe70000 [0096.358] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0096.363] GetProcessHeap () returned 0xe70000 [0096.363] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.363] GetProcessHeap () returned 0xe70000 [0096.363] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.572] GetProcessHeap () returned 0xe70000 [0096.572] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.572] GetProcessHeap () returned 0xe70000 [0096.572] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.580] GetProcessHeap () returned 0xe70000 [0096.580] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.580] GetProcessHeap () returned 0xe70000 [0096.580] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.582] GetProcessHeap () returned 0xe70000 [0096.582] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0096.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0096.589] GetProcessHeap () returned 0xe70000 [0096.589] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0096.589] GetProcessHeap () returned 0xe70000 [0096.589] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.589] GetProcessHeap () returned 0xe70000 [0096.589] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.591] GetProcessHeap () returned 0xe70000 [0096.591] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.591] GetProcessHeap () returned 0xe70000 [0096.591] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.601] GetProcessHeap () returned 0xe70000 [0096.601] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.601] GetProcessHeap () returned 0xe70000 [0096.601] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.933] GetProcessHeap () returned 0xe70000 [0096.933] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0096.933] GetProcessHeap () returned 0xe70000 [0096.933] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0096.936] GetProcessHeap () returned 0xe70000 [0096.936] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0096.937] GetProcessHeap () returned 0xe70000 [0096.937] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xf134b8 | out: hHeap=0xe70000) returned 1 [0096.938] GetProcessHeap () returned 0xe70000 [0096.938] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf134b8 [0096.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x327f298 | out: lpFindFileData=0x327f298*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9dfb986, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89340 [0096.940] GetProcessHeap () returned 0xe70000 [0096.940] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0096.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0096.942] GetProcessHeap () returned 0xe70000 [0096.942] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0096.942] GetProcessHeap () returned 0xe70000 [0096.942] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0096.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0096.952] GetProcessHeap () returned 0xe70000 [0096.952] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3900880 | out: hHeap=0xe70000) returned 1 [0096.952] GetProcessHeap () returned 0xe70000 [0096.952] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3900880 [0096.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x327f008 | out: lpFindFileData=0x327f008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89800 [0096.953] GetProcessHeap () returned 0xe70000 [0096.953] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0096.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0096.961] GetProcessHeap () returned 0xe70000 [0096.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0096.962] GetProcessHeap () returned 0xe70000 [0096.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0096.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0096.962] GetProcessHeap () returned 0xe70000 [0096.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0096.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0097.488] GetProcessHeap () returned 0xe70000 [0097.489] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0097.489] GetProcessHeap () returned 0xe70000 [0097.489] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0097.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0097.492] GetProcessHeap () returned 0xe70000 [0097.492] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0097.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0097.497] GetProcessHeap () returned 0xe70000 [0097.497] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0097.497] GetProcessHeap () returned 0xe70000 [0097.497] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0097.500] GetProcessHeap () returned 0xe70000 [0097.500] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0097.503] GetProcessHeap () returned 0xe70000 [0097.503] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0097.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0097.505] GetProcessHeap () returned 0xe70000 [0097.505] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0097.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0097.655] GetProcessHeap () returned 0xe70000 [0097.655] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0097.656] GetProcessHeap () returned 0xe70000 [0097.656] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0097.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0097.793] GetProcessHeap () returned 0xe70000 [0097.793] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0097.793] GetProcessHeap () returned 0xe70000 [0097.793] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0097.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0097.841] GetProcessHeap () returned 0xe70000 [0097.841] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0097.841] GetProcessHeap () returned 0xe70000 [0097.841] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0097.844] GetProcessHeap () returned 0xe70000 [0097.844] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0097.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0097.852] GetProcessHeap () returned 0xe70000 [0097.852] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0097.852] GetProcessHeap () returned 0xe70000 [0097.852] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0097.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0097.972] GetProcessHeap () returned 0xe70000 [0097.972] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0097.972] GetProcessHeap () returned 0xe70000 [0097.972] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0097.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0098.054] GetProcessHeap () returned 0xe70000 [0098.054] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0098.054] GetProcessHeap () returned 0xe70000 [0098.054] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0098.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0100.057] GetProcessHeap () returned 0xe70000 [0100.057] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0100.381] GetProcessHeap () returned 0xe70000 [0100.381] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0100.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0100.382] GetProcessHeap () returned 0xe70000 [0100.382] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0100.382] GetProcessHeap () returned 0xe70000 [0100.382] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0100.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0100.384] GetProcessHeap () returned 0xe70000 [0100.385] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0100.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0100.396] GetProcessHeap () returned 0xe70000 [0100.396] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0100.396] GetProcessHeap () returned 0xe70000 [0100.396] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0100.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0100.398] GetProcessHeap () returned 0xe70000 [0100.398] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0100.398] GetProcessHeap () returned 0xe70000 [0100.398] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0100.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0100.400] GetProcessHeap () returned 0xe70000 [0100.400] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0100.400] GetProcessHeap () returned 0xe70000 [0100.400] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0100.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0100.408] GetProcessHeap () returned 0xe70000 [0100.408] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0100.408] GetProcessHeap () returned 0xe70000 [0100.408] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3920890 | out: hHeap=0xe70000) returned 1 [0100.411] GetProcessHeap () returned 0xe70000 [0100.411] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3920890 [0100.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x327ed78 | out: lpFindFileData=0x327ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89400 [0100.421] GetProcessHeap () returned 0xe70000 [0100.421] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0100.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0100.425] GetProcessHeap () returned 0xe70000 [0100.425] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0100.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0100.426] GetProcessHeap () returned 0xe70000 [0100.426] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0100.426] GetProcessHeap () returned 0xe70000 [0100.427] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0100.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x99937c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99937c0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0100.619] GetProcessHeap () returned 0xe70000 [0100.619] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0100.661] GetProcessHeap () returned 0xe70000 [0100.661] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0100.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0100.848] GetProcessHeap () returned 0xe70000 [0100.848] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0100.849] GetProcessHeap () returned 0xe70000 [0100.849] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0100.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0100.967] GetProcessHeap () returned 0xe70000 [0100.967] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0100.967] GetProcessHeap () returned 0xe70000 [0100.967] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0100.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0100.973] GetProcessHeap () returned 0xe70000 [0100.973] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0101.003] GetProcessHeap () returned 0xe70000 [0101.003] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0101.006] GetProcessHeap () returned 0xe70000 [0101.006] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0101.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0101.209] GetProcessHeap () returned 0xe70000 [0101.209] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0101.209] GetProcessHeap () returned 0xe70000 [0101.210] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0101.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0101.210] GetProcessHeap () returned 0xe70000 [0101.210] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0101.210] GetProcessHeap () returned 0xe70000 [0101.210] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0101.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0101.211] GetProcessHeap () returned 0xe70000 [0101.211] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0101.211] GetProcessHeap () returned 0xe70000 [0101.211] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0101.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1335b74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1335b74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0101.218] GetProcessHeap () returned 0xe70000 [0101.218] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3930898 | out: hHeap=0xe70000) returned 1 [0101.218] GetProcessHeap () returned 0xe70000 [0101.219] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3930898 [0101.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\*", lpFindFileData=0x327eae8 | out: lpFindFileData=0x327eae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe894c0 [0101.219] GetProcessHeap () returned 0xe70000 [0101.219] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0101.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe89500 [0101.220] GetProcessHeap () returned 0xe70000 [0101.220] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0101.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0278 [0101.222] GetProcessHeap () returned 0xe70000 [0101.222] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0101.226] GetProcessHeap () returned 0xe70000 [0101.226] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.226] GetProcessHeap () returned 0xe70000 [0101.226] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0378 [0101.280] GetProcessHeap () returned 0xe70000 [0101.280] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.280] GetProcessHeap () returned 0xe70000 [0101.280] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0101.287] GetProcessHeap () returned 0xe70000 [0101.287] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.287] GetProcessHeap () returned 0xe70000 [0101.287] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefeb8 [0101.530] GetProcessHeap () returned 0xe70000 [0101.530] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.530] GetProcessHeap () returned 0xe70000 [0101.530] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0101.549] GetProcessHeap () returned 0xe70000 [0101.549] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.550] GetProcessHeap () returned 0xe70000 [0101.550] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0101.554] GetProcessHeap () returned 0xe70000 [0101.554] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.554] GetProcessHeap () returned 0xe70000 [0101.554] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0101.561] GetProcessHeap () returned 0xe70000 [0101.561] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.561] GetProcessHeap () returned 0xe70000 [0101.561] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0101.567] GetProcessHeap () returned 0xe70000 [0101.567] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.567] GetProcessHeap () returned 0xe70000 [0101.567] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0101.571] GetProcessHeap () returned 0xe70000 [0101.571] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.571] GetProcessHeap () returned 0xe70000 [0101.571] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02f8 [0101.937] GetProcessHeap () returned 0xe70000 [0101.937] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.937] GetProcessHeap () returned 0xe70000 [0101.937] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef05b8 [0101.941] GetProcessHeap () returned 0xe70000 [0101.941] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.941] GetProcessHeap () returned 0xe70000 [0101.941] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00f8 [0101.946] GetProcessHeap () returned 0xe70000 [0101.946] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.946] GetProcessHeap () returned 0xe70000 [0101.946] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03b8 [0101.951] GetProcessHeap () returned 0xe70000 [0101.951] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.952] GetProcessHeap () returned 0xe70000 [0101.952] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0101.958] GetProcessHeap () returned 0xe70000 [0101.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.958] GetProcessHeap () returned 0xe70000 [0101.958] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0101.962] GetProcessHeap () returned 0xe70000 [0101.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0101.962] GetProcessHeap () returned 0xe70000 [0101.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0101.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef05b8 [0102.672] GetProcessHeap () returned 0xe70000 [0102.672] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0102.672] GetProcessHeap () returned 0xe70000 [0102.672] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0102.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04f8 [0102.682] GetProcessHeap () returned 0xe70000 [0102.682] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0102.682] GetProcessHeap () returned 0xe70000 [0102.682] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0102.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0102.690] GetProcessHeap () returned 0xe70000 [0102.690] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0102.691] GetProcessHeap () returned 0xe70000 [0102.691] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0102.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0102.701] GetProcessHeap () returned 0xe70000 [0102.701] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0102.701] GetProcessHeap () returned 0xe70000 [0102.702] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0102.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0102.706] GetProcessHeap () returned 0xe70000 [0102.706] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0102.706] GetProcessHeap () returned 0xe70000 [0102.706] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0102.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef05b8 [0104.704] GetProcessHeap () returned 0xe70000 [0104.704] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.704] GetProcessHeap () returned 0xe70000 [0104.704] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0104.708] GetProcessHeap () returned 0xe70000 [0104.708] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.708] GetProcessHeap () returned 0xe70000 [0104.709] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0104.719] GetProcessHeap () returned 0xe70000 [0104.719] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.719] GetProcessHeap () returned 0xe70000 [0104.720] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefdf8 [0104.724] GetProcessHeap () returned 0xe70000 [0104.724] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.724] GetProcessHeap () returned 0xe70000 [0104.724] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ms\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0078 [0104.728] GetProcessHeap () returned 0xe70000 [0104.728] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.728] GetProcessHeap () returned 0xe70000 [0104.728] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\nl\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0104.734] GetProcessHeap () returned 0xe70000 [0104.734] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.735] GetProcessHeap () returned 0xe70000 [0104.735] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\no\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff78 [0104.739] GetProcessHeap () returned 0xe70000 [0104.739] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.739] GetProcessHeap () returned 0xe70000 [0104.739] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pl\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03b8 [0104.743] GetProcessHeap () returned 0xe70000 [0104.743] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0104.743] GetProcessHeap () returned 0xe70000 [0104.743] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0104.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-BR\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0106.073] GetProcessHeap () returned 0xe70000 [0106.073] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.073] GetProcessHeap () returned 0xe70000 [0106.073] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-pt\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0106.086] GetProcessHeap () returned 0xe70000 [0106.087] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.087] GetProcessHeap () returned 0xe70000 [0106.087] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ro\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0106.091] GetProcessHeap () returned 0xe70000 [0106.091] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.091] GetProcessHeap () returned 0xe70000 [0106.091] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ru\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0106.096] GetProcessHeap () returned 0xe70000 [0106.096] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.096] GetProcessHeap () returned 0xe70000 [0106.096] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0106.106] GetProcessHeap () returned 0xe70000 [0106.106] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.106] GetProcessHeap () returned 0xe70000 [0106.106] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sl\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0106.117] GetProcessHeap () returned 0xe70000 [0106.117] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.117] GetProcessHeap () returned 0xe70000 [0106.117] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Cyrl\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03b8 [0106.507] GetProcessHeap () returned 0xe70000 [0106.507] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.507] GetProcessHeap () returned 0xe70000 [0106.507] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0106.512] GetProcessHeap () returned 0xe70000 [0106.512] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.512] GetProcessHeap () returned 0xe70000 [0106.512] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn-CS\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe78 [0106.519] GetProcessHeap () returned 0xe70000 [0106.519] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.520] GetProcessHeap () returned 0xe70000 [0106.520] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sv\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0578 [0106.524] GetProcessHeap () returned 0xe70000 [0106.524] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.524] GetProcessHeap () returned 0xe70000 [0106.524] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\th\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1860d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0106.529] GetProcessHeap () returned 0xe70000 [0106.529] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.529] GetProcessHeap () returned 0xe70000 [0106.529] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\tr\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0078 [0106.535] GetProcessHeap () returned 0xe70000 [0106.535] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.535] GetProcessHeap () returned 0xe70000 [0106.535] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\uk\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04b8 [0106.946] GetProcessHeap () returned 0xe70000 [0106.946] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.946] GetProcessHeap () returned 0xe70000 [0106.947] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\vi\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0538 [0106.951] GetProcessHeap () returned 0xe70000 [0106.951] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.951] GetProcessHeap () returned 0xe70000 [0106.951] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0378 [0106.956] GetProcessHeap () returned 0xe70000 [0106.956] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.956] GetProcessHeap () returned 0xe70000 [0106.956] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39608b0 [0106.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANT\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0106.960] GetProcessHeap () returned 0xe70000 [0106.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39608b0 | out: hHeap=0xe70000) returned 1 [0106.960] GetProcessHeap () returned 0xe70000 [0106.961] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0106.961] GetProcessHeap () returned 0xe70000 [0106.961] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0106.963] GetProcessHeap () returned 0xe70000 [0106.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0106.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0278 [0106.969] GetProcessHeap () returned 0xe70000 [0106.969] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0106.970] GetProcessHeap () returned 0xe70000 [0106.970] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0106.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0106.971] GetProcessHeap () returned 0xe70000 [0106.971] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0106.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefeb8 [0106.975] GetProcessHeap () returned 0xe70000 [0106.975] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0106.975] GetProcessHeap () returned 0xe70000 [0106.976] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0106.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0106.980] GetProcessHeap () returned 0xe70000 [0106.980] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0106.980] GetProcessHeap () returned 0xe70000 [0106.980] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0106.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0538 [0106.984] GetProcessHeap () returned 0xe70000 [0106.984] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0106.984] GetProcessHeap () returned 0xe70000 [0106.984] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0106.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0107.332] GetProcessHeap () returned 0xe70000 [0107.332] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.332] GetProcessHeap () returned 0xe70000 [0107.332] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff78 [0107.343] GetProcessHeap () returned 0xe70000 [0107.343] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.343] GetProcessHeap () returned 0xe70000 [0107.343] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0378 [0107.348] GetProcessHeap () returned 0xe70000 [0107.348] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.348] GetProcessHeap () returned 0xe70000 [0107.348] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01b8 [0107.352] GetProcessHeap () returned 0xe70000 [0107.352] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.352] GetProcessHeap () returned 0xe70000 [0107.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0107.361] GetProcessHeap () returned 0xe70000 [0107.362] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.362] GetProcessHeap () returned 0xe70000 [0107.362] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0107.366] GetProcessHeap () returned 0xe70000 [0107.366] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.366] GetProcessHeap () returned 0xe70000 [0107.366] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01b8 [0107.370] GetProcessHeap () returned 0xe70000 [0107.370] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.370] GetProcessHeap () returned 0xe70000 [0107.370] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0438 [0107.374] GetProcessHeap () returned 0xe70000 [0107.374] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.374] GetProcessHeap () returned 0xe70000 [0107.375] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01b8 [0107.886] GetProcessHeap () returned 0xe70000 [0107.886] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.886] GetProcessHeap () returned 0xe70000 [0107.886] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefff8 [0107.894] GetProcessHeap () returned 0xe70000 [0107.894] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.894] GetProcessHeap () returned 0xe70000 [0107.894] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0438 [0107.898] GetProcessHeap () returned 0xe70000 [0107.898] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.898] GetProcessHeap () returned 0xe70000 [0107.898] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0107.902] GetProcessHeap () returned 0xe70000 [0107.902] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.902] GetProcessHeap () returned 0xe70000 [0107.903] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0278 [0107.907] GetProcessHeap () returned 0xe70000 [0107.907] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.907] GetProcessHeap () returned 0xe70000 [0107.907] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0107.911] GetProcessHeap () returned 0xe70000 [0107.911] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.912] GetProcessHeap () returned 0xe70000 [0107.912] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00f8 [0107.916] GetProcessHeap () returned 0xe70000 [0107.916] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.916] GetProcessHeap () returned 0xe70000 [0107.916] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0107.920] GetProcessHeap () returned 0xe70000 [0107.920] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0107.920] GetProcessHeap () returned 0xe70000 [0107.920] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0107.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0108.602] GetProcessHeap () returned 0xe70000 [0108.602] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.603] GetProcessHeap () returned 0xe70000 [0108.603] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefff8 [0108.607] GetProcessHeap () returned 0xe70000 [0108.607] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.607] GetProcessHeap () returned 0xe70000 [0108.607] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04b8 [0108.612] GetProcessHeap () returned 0xe70000 [0108.612] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.612] GetProcessHeap () returned 0xe70000 [0108.612] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0238 [0108.616] GetProcessHeap () returned 0xe70000 [0108.616] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.616] GetProcessHeap () returned 0xe70000 [0108.616] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0108.620] GetProcessHeap () returned 0xe70000 [0108.620] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.621] GetProcessHeap () returned 0xe70000 [0108.621] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04b8 [0108.626] GetProcessHeap () returned 0xe70000 [0108.626] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.627] GetProcessHeap () returned 0xe70000 [0108.627] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00f8 [0108.631] GetProcessHeap () returned 0xe70000 [0108.631] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.631] GetProcessHeap () returned 0xe70000 [0108.631] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0108.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04b8 [0108.906] GetProcessHeap () returned 0xe70000 [0108.906] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0108.908] GetProcessHeap () returned 0xe70000 [0108.908] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0438 [0108.912] GetProcessHeap () returned 0xe70000 [0108.912] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0108.912] GetProcessHeap () returned 0xe70000 [0108.913] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0438 [0108.918] GetProcessHeap () returned 0xe70000 [0108.918] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0108.918] GetProcessHeap () returned 0xe70000 [0108.918] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefff8 [0108.928] GetProcessHeap () returned 0xe70000 [0108.928] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0108.928] GetProcessHeap () returned 0xe70000 [0108.928] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02b8 [0108.932] GetProcessHeap () returned 0xe70000 [0108.932] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0108.932] GetProcessHeap () returned 0xe70000 [0108.932] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0108.937] GetProcessHeap () returned 0xe70000 [0108.937] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0108.937] GetProcessHeap () returned 0xe70000 [0108.937] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0238 [0108.942] GetProcessHeap () returned 0xe70000 [0108.942] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0108.942] GetProcessHeap () returned 0xe70000 [0108.942] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0108.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04f8 [0109.240] GetProcessHeap () returned 0xe70000 [0109.240] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.240] GetProcessHeap () returned 0xe70000 [0109.240] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0109.244] GetProcessHeap () returned 0xe70000 [0109.244] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.244] GetProcessHeap () returned 0xe70000 [0109.244] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0109.252] GetProcessHeap () returned 0xe70000 [0109.252] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.253] GetProcessHeap () returned 0xe70000 [0109.253] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0538 [0109.256] GetProcessHeap () returned 0xe70000 [0109.257] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.257] GetProcessHeap () returned 0xe70000 [0109.257] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff78 [0109.262] GetProcessHeap () returned 0xe70000 [0109.262] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.262] GetProcessHeap () returned 0xe70000 [0109.262] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefdf8 [0109.266] GetProcessHeap () returned 0xe70000 [0109.266] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.266] GetProcessHeap () returned 0xe70000 [0109.266] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0109.272] GetProcessHeap () returned 0xe70000 [0109.272] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.273] GetProcessHeap () returned 0xe70000 [0109.273] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefdf8 [0109.276] GetProcessHeap () returned 0xe70000 [0109.276] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.277] GetProcessHeap () returned 0xe70000 [0109.277] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00f8 [0109.281] GetProcessHeap () returned 0xe70000 [0109.281] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.281] GetProcessHeap () returned 0xe70000 [0109.281] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0109.632] GetProcessHeap () returned 0xe70000 [0109.632] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.635] GetProcessHeap () returned 0xe70000 [0109.635] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02b8 [0109.640] GetProcessHeap () returned 0xe70000 [0109.640] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3d00048 | out: hHeap=0xe70000) returned 1 [0109.640] GetProcessHeap () returned 0xe70000 [0109.640] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.645] GetProcessHeap () returned 0xe70000 [0109.645] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0109.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\*", lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0078 [0109.646] GetProcessHeap () returned 0xe70000 [0109.646] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0109.653] GetProcessHeap () returned 0xe70000 [0109.653] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.653] GetProcessHeap () returned 0xe70000 [0109.653] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0578 [0109.661] GetProcessHeap () returned 0xe70000 [0109.661] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.661] GetProcessHeap () returned 0xe70000 [0109.661] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0438 [0109.666] GetProcessHeap () returned 0xe70000 [0109.666] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.666] GetProcessHeap () returned 0xe70000 [0109.666] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0109.932] GetProcessHeap () returned 0xe70000 [0109.932] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.932] GetProcessHeap () returned 0xe70000 [0109.932] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0109.937] GetProcessHeap () returned 0xe70000 [0109.937] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.937] GetProcessHeap () returned 0xe70000 [0109.938] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0109.950] GetProcessHeap () returned 0xe70000 [0109.950] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.950] GetProcessHeap () returned 0xe70000 [0109.950] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef05b8 [0109.955] GetProcessHeap () returned 0xe70000 [0109.955] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.955] GetProcessHeap () returned 0xe70000 [0109.955] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0109.960] GetProcessHeap () returned 0xe70000 [0109.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.960] GetProcessHeap () returned 0xe70000 [0109.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04f8 [0109.962] GetProcessHeap () returned 0xe70000 [0109.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.962] GetProcessHeap () returned 0xe70000 [0109.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02b8 [0109.970] GetProcessHeap () returned 0xe70000 [0109.970] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.970] GetProcessHeap () returned 0xe70000 [0109.970] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02f8 [0109.974] GetProcessHeap () returned 0xe70000 [0109.974] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.974] GetProcessHeap () returned 0xe70000 [0109.975] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0109.979] GetProcessHeap () returned 0xe70000 [0109.979] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0109.979] GetProcessHeap () returned 0xe70000 [0109.979] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0109.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0109.985] GetProcessHeap () returned 0xe70000 [0110.274] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.324] GetProcessHeap () returned 0xe70000 [0110.324] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0110.331] GetProcessHeap () returned 0xe70000 [0110.331] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.332] GetProcessHeap () returned 0xe70000 [0110.332] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0110.336] GetProcessHeap () returned 0xe70000 [0110.336] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.336] GetProcessHeap () returned 0xe70000 [0110.336] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0578 [0110.340] GetProcessHeap () returned 0xe70000 [0110.340] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.340] GetProcessHeap () returned 0xe70000 [0110.341] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff78 [0110.347] GetProcessHeap () returned 0xe70000 [0110.347] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.347] GetProcessHeap () returned 0xe70000 [0110.347] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0110.352] GetProcessHeap () returned 0xe70000 [0110.352] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.352] GetProcessHeap () returned 0xe70000 [0110.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0438 [0110.356] GetProcessHeap () returned 0xe70000 [0110.357] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.357] GetProcessHeap () returned 0xe70000 [0110.357] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0110.872] GetProcessHeap () returned 0xe70000 [0110.872] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.874] GetProcessHeap () returned 0xe70000 [0110.874] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0110.882] GetProcessHeap () returned 0xe70000 [0110.882] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.882] GetProcessHeap () returned 0xe70000 [0110.882] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0110.888] GetProcessHeap () returned 0xe70000 [0110.888] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.888] GetProcessHeap () returned 0xe70000 [0110.888] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefff8 [0110.894] GetProcessHeap () returned 0xe70000 [0110.894] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.894] GetProcessHeap () returned 0xe70000 [0110.894] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0110.900] GetProcessHeap () returned 0xe70000 [0110.900] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.900] GetProcessHeap () returned 0xe70000 [0110.900] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0110.905] GetProcessHeap () returned 0xe70000 [0110.905] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.905] GetProcessHeap () returned 0xe70000 [0110.905] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefff8 [0110.910] GetProcessHeap () returned 0xe70000 [0110.910] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0110.911] GetProcessHeap () returned 0xe70000 [0110.911] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0110.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0111.567] GetProcessHeap () returned 0xe70000 [0111.567] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0111.567] GetProcessHeap () returned 0xe70000 [0111.567] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0111.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0111.572] GetProcessHeap () returned 0xe70000 [0111.572] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0111.572] GetProcessHeap () returned 0xe70000 [0111.572] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0111.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01b8 [0111.577] GetProcessHeap () returned 0xe70000 [0111.577] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0111.577] GetProcessHeap () returned 0xe70000 [0111.577] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0111.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0111.583] GetProcessHeap () returned 0xe70000 [0111.583] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0111.583] GetProcessHeap () returned 0xe70000 [0111.583] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0111.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0111.590] GetProcessHeap () returned 0xe70000 [0111.590] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0111.590] GetProcessHeap () returned 0xe70000 [0111.590] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0111.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefff8 [0111.594] GetProcessHeap () returned 0xe70000 [0111.595] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0111.595] GetProcessHeap () returned 0xe70000 [0111.595] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0111.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02f8 [0111.598] GetProcessHeap () returned 0xe70000 [0111.598] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0111.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf145ad52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0111.599] GetProcessHeap () returned 0xe70000 [0111.599] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0111.599] GetProcessHeap () returned 0xe70000 [0111.599] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0111.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0111.600] GetProcessHeap () returned 0xe70000 [0111.600] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0111.600] GetProcessHeap () returned 0xe70000 [0111.600] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0111.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefeb8 [0112.360] GetProcessHeap () returned 0xe70000 [0112.360] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.360] GetProcessHeap () returned 0xe70000 [0112.360] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0112.361] GetProcessHeap () returned 0xe70000 [0112.361] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.361] GetProcessHeap () returned 0xe70000 [0112.361] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0112.361] GetProcessHeap () returned 0xe70000 [0112.361] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.362] GetProcessHeap () returned 0xe70000 [0112.362] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0038 [0112.362] GetProcessHeap () returned 0xe70000 [0112.362] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.362] GetProcessHeap () returned 0xe70000 [0112.362] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0112.363] GetProcessHeap () returned 0xe70000 [0112.446] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.446] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0112.446] GetProcessHeap () returned 0xe70000 [0112.446] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef02b8 [0112.446] FindNextFileW (in: hFindFile=0xef02b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.447] FindNextFileW (in: hFindFile=0xef02b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x116c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.447] FindNextFileW (in: hFindFile=0xef02b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x116c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.447] FindClose (in: hFindFile=0xef02b8 | out: hFindFile=0xef02b8) returned 1 [0112.447] GetProcessHeap () returned 0xe70000 [0112.447] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.447] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0112.447] GetProcessHeap () returned 0xe70000 [0112.447] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0112.450] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.451] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.451] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.451] FindClose (in: hFindFile=0xeeffb8 | out: hFindFile=0xeeffb8) returned 1 [0112.451] GetProcessHeap () returned 0xe70000 [0112.451] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.451] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0112.451] GetProcessHeap () returned 0xe70000 [0112.451] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0112.452] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.452] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.452] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.452] FindClose (in: hFindFile=0xef01f8 | out: hFindFile=0xef01f8) returned 1 [0112.452] GetProcessHeap () returned 0xe70000 [0112.452] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.452] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0112.452] GetProcessHeap () returned 0xe70000 [0112.453] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0378 [0112.456] FindNextFileW (in: hFindFile=0xef0378, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.456] FindNextFileW (in: hFindFile=0xef0378, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.456] FindNextFileW (in: hFindFile=0xef0378, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.456] FindClose (in: hFindFile=0xef0378 | out: hFindFile=0xef0378) returned 1 [0112.456] GetProcessHeap () returned 0xe70000 [0112.456] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.456] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0112.456] GetProcessHeap () returned 0xe70000 [0112.457] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0112.457] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.457] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.457] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.457] FindClose (in: hFindFile=0xef03f8 | out: hFindFile=0xef03f8) returned 1 [0112.457] GetProcessHeap () returned 0xe70000 [0112.458] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.458] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0112.458] GetProcessHeap () returned 0xe70000 [0112.458] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0112.458] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.458] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11460, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.459] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11460, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.459] FindClose (in: hFindFile=0xef03f8 | out: hFindFile=0xef03f8) returned 1 [0112.459] GetProcessHeap () returned 0xe70000 [0112.459] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.459] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0112.459] GetProcessHeap () returned 0xe70000 [0112.459] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0478 [0112.462] FindNextFileW (in: hFindFile=0xef0478, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.462] FindNextFileW (in: hFindFile=0xef0478, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.462] FindNextFileW (in: hFindFile=0xef0478, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.462] FindClose (in: hFindFile=0xef0478 | out: hFindFile=0xef0478) returned 1 [0112.462] GetProcessHeap () returned 0xe70000 [0112.462] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.463] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0112.463] GetProcessHeap () returned 0xe70000 [0112.463] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef05b8 [0112.466] FindNextFileW (in: hFindFile=0xef05b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.466] FindNextFileW (in: hFindFile=0xef05b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.466] FindNextFileW (in: hFindFile=0xef05b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.466] FindClose (in: hFindFile=0xef05b8 | out: hFindFile=0xef05b8) returned 1 [0112.467] GetProcessHeap () returned 0xe70000 [0112.467] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0112.467] GetProcessHeap () returned 0xe70000 [0112.467] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04f8 [0112.467] FindNextFileW (in: hFindFile=0xef04f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.468] FindNextFileW (in: hFindFile=0xef04f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.468] FindNextFileW (in: hFindFile=0xef04f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.468] FindClose (in: hFindFile=0xef04f8 | out: hFindFile=0xef04f8) returned 1 [0112.468] GetProcessHeap () returned 0xe70000 [0112.468] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.468] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0112.468] GetProcessHeap () returned 0xe70000 [0112.468] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0112.469] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.469] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.469] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.469] FindClose (in: hFindFile=0xef0178 | out: hFindFile=0xef0178) returned 1 [0112.469] GetProcessHeap () returned 0xe70000 [0112.469] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.470] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0112.470] GetProcessHeap () returned 0xe70000 [0112.470] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0112.471] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.472] FindClose (in: hFindFile=0xef01f8 | out: hFindFile=0xef01f8) returned 1 [0112.472] GetProcessHeap () returned 0xe70000 [0112.472] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.472] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0112.472] GetProcessHeap () returned 0xe70000 [0112.472] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0112.473] FindNextFileW (in: hFindFile=0xeeff38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.473] FindNextFileW (in: hFindFile=0xeeff38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.473] FindNextFileW (in: hFindFile=0xeeff38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.473] FindClose (in: hFindFile=0xeeff38 | out: hFindFile=0xeeff38) returned 1 [0112.473] GetProcessHeap () returned 0xe70000 [0112.473] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.474] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0112.474] GetProcessHeap () returned 0xe70000 [0112.474] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef05b8 [0112.474] FindNextFileW (in: hFindFile=0xef05b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.474] FindNextFileW (in: hFindFile=0xef05b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.474] FindNextFileW (in: hFindFile=0xef05b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.475] FindClose (in: hFindFile=0xef05b8 | out: hFindFile=0xef05b8) returned 1 [0112.475] GetProcessHeap () returned 0xe70000 [0112.475] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.475] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0112.475] GetProcessHeap () returned 0xe70000 [0112.475] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef01f8 [0112.476] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.476] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.476] FindNextFileW (in: hFindFile=0xef01f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.476] FindClose (in: hFindFile=0xef01f8 | out: hFindFile=0xef01f8) returned 1 [0112.476] GetProcessHeap () returned 0xe70000 [0112.476] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.882] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1048", cAlternateFileName="")) returned 1 [0112.882] GetProcessHeap () returned 0xe70000 [0112.882] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0112.884] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.884] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.885] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.885] FindClose (in: hFindFile=0xeefe38 | out: hFindFile=0xeefe38) returned 1 [0112.885] GetProcessHeap () returned 0xe70000 [0112.885] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.885] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0112.885] GetProcessHeap () returned 0xe70000 [0112.885] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefdf8 [0112.886] FindNextFileW (in: hFindFile=0xeefdf8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.886] FindNextFileW (in: hFindFile=0xeefdf8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.886] FindNextFileW (in: hFindFile=0xeefdf8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.886] FindClose (in: hFindFile=0xeefdf8 | out: hFindFile=0xeefdf8) returned 1 [0112.886] GetProcessHeap () returned 0xe70000 [0112.886] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.886] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1050", cAlternateFileName="")) returned 1 [0112.886] GetProcessHeap () returned 0xe70000 [0112.886] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0112.887] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.887] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.887] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.887] FindClose (in: hFindFile=0xef00b8 | out: hFindFile=0xef00b8) returned 1 [0112.887] GetProcessHeap () returned 0xe70000 [0112.888] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.888] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1051", cAlternateFileName="")) returned 1 [0112.888] GetProcessHeap () returned 0xe70000 [0112.888] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0112.888] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.888] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.888] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.889] FindClose (in: hFindFile=0xeeffb8 | out: hFindFile=0xeeffb8) returned 1 [0112.897] GetProcessHeap () returned 0xe70000 [0112.897] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.897] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0112.897] GetProcessHeap () returned 0xe70000 [0112.897] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff78 [0112.898] FindNextFileW (in: hFindFile=0xeeff78, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.898] FindNextFileW (in: hFindFile=0xeeff78, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.898] FindNextFileW (in: hFindFile=0xeeff78, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.898] FindClose (in: hFindFile=0xeeff78 | out: hFindFile=0xeeff78) returned 1 [0112.898] GetProcessHeap () returned 0xe70000 [0112.898] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.898] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1054", cAlternateFileName="")) returned 1 [0112.899] GetProcessHeap () returned 0xe70000 [0112.899] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0112.900] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.900] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.900] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.900] FindClose (in: hFindFile=0xef03f8 | out: hFindFile=0xef03f8) returned 1 [0112.900] GetProcessHeap () returned 0xe70000 [0112.901] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.901] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0112.901] GetProcessHeap () returned 0xe70000 [0112.901] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0112.901] FindNextFileW (in: hFindFile=0xef0338, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.901] FindNextFileW (in: hFindFile=0xef0338, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.901] FindNextFileW (in: hFindFile=0xef0338, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.902] FindClose (in: hFindFile=0xef0338 | out: hFindFile=0xef0338) returned 1 [0112.902] GetProcessHeap () returned 0xe70000 [0112.902] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.902] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1057", cAlternateFileName="")) returned 1 [0112.902] GetProcessHeap () returned 0xe70000 [0112.902] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0338 [0112.902] FindNextFileW (in: hFindFile=0xef0338, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.903] FindNextFileW (in: hFindFile=0xef0338, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.903] FindNextFileW (in: hFindFile=0xef0338, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.903] FindClose (in: hFindFile=0xef0338 | out: hFindFile=0xef0338) returned 1 [0112.903] GetProcessHeap () returned 0xe70000 [0112.903] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.903] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1058", cAlternateFileName="")) returned 1 [0112.903] GetProcessHeap () returned 0xe70000 [0112.903] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0112.905] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.905] FindClose (in: hFindFile=0xeeffb8 | out: hFindFile=0xeeffb8) returned 1 [0112.905] GetProcessHeap () returned 0xe70000 [0112.905] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.905] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1060", cAlternateFileName="")) returned 1 [0112.905] GetProcessHeap () returned 0xe70000 [0112.905] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0112.907] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.907] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.907] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.907] FindClose (in: hFindFile=0xef0138 | out: hFindFile=0xef0138) returned 1 [0112.907] GetProcessHeap () returned 0xe70000 [0112.907] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.907] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1061", cAlternateFileName="")) returned 1 [0112.908] GetProcessHeap () returned 0xe70000 [0112.908] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0112.908] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.908] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.908] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.908] FindClose (in: hFindFile=0xef03f8 | out: hFindFile=0xef03f8) returned 1 [0112.909] GetProcessHeap () returned 0xe70000 [0112.909] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.909] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1062", cAlternateFileName="")) returned 1 [0112.909] GetProcessHeap () returned 0xe70000 [0112.909] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0112.909] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.909] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.909] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.910] FindClose (in: hFindFile=0xeefe38 | out: hFindFile=0xeefe38) returned 1 [0112.910] GetProcessHeap () returned 0xe70000 [0112.910] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.910] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1063", cAlternateFileName="")) returned 1 [0112.910] GetProcessHeap () returned 0xe70000 [0112.910] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0112.910] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.911] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.911] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.911] FindClose (in: hFindFile=0xef03f8 | out: hFindFile=0xef03f8) returned 1 [0112.911] GetProcessHeap () returned 0xe70000 [0112.911] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.911] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1066", cAlternateFileName="")) returned 1 [0112.911] GetProcessHeap () returned 0xe70000 [0112.911] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0112.913] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.913] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.913] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.913] FindClose (in: hFindFile=0xef00b8 | out: hFindFile=0xef00b8) returned 1 [0112.913] GetProcessHeap () returned 0xe70000 [0112.913] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.913] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1069", cAlternateFileName="")) returned 1 [0112.913] GetProcessHeap () returned 0xe70000 [0112.913] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefeb8 [0112.915] FindNextFileW (in: hFindFile=0xeefeb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.915] FindNextFileW (in: hFindFile=0xeefeb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.916] FindNextFileW (in: hFindFile=0xeefeb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.916] FindClose (in: hFindFile=0xeefeb8 | out: hFindFile=0xeefeb8) returned 1 [0112.916] GetProcessHeap () returned 0xe70000 [0112.916] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.916] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1081", cAlternateFileName="")) returned 1 [0112.916] GetProcessHeap () returned 0xe70000 [0112.916] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0578 [0112.917] FindNextFileW (in: hFindFile=0xef0578, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.918] FindNextFileW (in: hFindFile=0xef0578, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.918] FindNextFileW (in: hFindFile=0xef0578, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.918] FindClose (in: hFindFile=0xef0578 | out: hFindFile=0xef0578) returned 1 [0112.918] GetProcessHeap () returned 0xe70000 [0112.918] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.918] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1086", cAlternateFileName="")) returned 1 [0112.918] GetProcessHeap () returned 0xe70000 [0112.918] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeff38 [0112.919] FindNextFileW (in: hFindFile=0xeeff38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.919] FindNextFileW (in: hFindFile=0xeeff38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7abb0bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.919] FindNextFileW (in: hFindFile=0xeeff38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7abb0bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.919] FindClose (in: hFindFile=0xeeff38 | out: hFindFile=0xeeff38) returned 1 [0112.919] GetProcessHeap () returned 0xe70000 [0112.919] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.919] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1087", cAlternateFileName="")) returned 1 [0112.920] GetProcessHeap () returned 0xe70000 [0112.920] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0112.921] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.921] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.921] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.921] FindClose (in: hFindFile=0xef00b8 | out: hFindFile=0xef00b8) returned 1 [0112.921] GetProcessHeap () returned 0xe70000 [0112.921] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.921] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1110", cAlternateFileName="")) returned 1 [0112.921] GetProcessHeap () returned 0xe70000 [0112.922] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef03f8 [0112.922] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.922] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.922] FindNextFileW (in: hFindFile=0xef03f8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.922] FindClose (in: hFindFile=0xef03f8 | out: hFindFile=0xef03f8) returned 1 [0112.922] GetProcessHeap () returned 0xe70000 [0112.923] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.923] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0112.923] GetProcessHeap () returned 0xe70000 [0112.923] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0138 [0112.923] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.923] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.923] FindNextFileW (in: hFindFile=0xef0138, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.924] FindClose (in: hFindFile=0xef0138 | out: hFindFile=0xef0138) returned 1 [0112.924] GetProcessHeap () returned 0xe70000 [0112.924] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.924] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0112.924] GetProcessHeap () returned 0xe70000 [0112.924] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0538 [0112.924] FindNextFileW (in: hFindFile=0xef0538, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.925] FindNextFileW (in: hFindFile=0xef0538, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.925] FindNextFileW (in: hFindFile=0xef0538, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.925] FindClose (in: hFindFile=0xef0538 | out: hFindFile=0xef0538) returned 1 [0112.925] GetProcessHeap () returned 0xe70000 [0112.925] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.925] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2074", cAlternateFileName="")) returned 1 [0112.925] GetProcessHeap () returned 0xe70000 [0112.925] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0112.926] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.926] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.926] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.926] FindClose (in: hFindFile=0xeefe38 | out: hFindFile=0xeefe38) returned 1 [0112.926] GetProcessHeap () returned 0xe70000 [0112.926] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.926] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0112.927] GetProcessHeap () returned 0xe70000 [0112.927] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef04b8 [0112.927] FindNextFileW (in: hFindFile=0xef04b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.927] FindNextFileW (in: hFindFile=0xef04b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.927] FindNextFileW (in: hFindFile=0xef04b8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.927] FindClose (in: hFindFile=0xef04b8 | out: hFindFile=0xef04b8) returned 1 [0112.928] GetProcessHeap () returned 0xe70000 [0112.928] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.928] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9242", cAlternateFileName="")) returned 1 [0112.928] GetProcessHeap () returned 0xe70000 [0112.928] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39508a8 [0112.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\*", lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0112.928] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.928] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0112.929] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e338 | out: lpFindFileData=0x327e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0112.929] FindClose (in: hFindFile=0xeeffb8 | out: hFindFile=0xeeffb8) returned 1 [0112.929] GetProcessHeap () returned 0xe70000 [0112.929] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39508a8 | out: hHeap=0xe70000) returned 1 [0112.929] FindNextFileW (in: hFindFile=0xef02f8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9242", cAlternateFileName="")) returned 0 [0112.929] FindClose (in: hFindFile=0xef02f8 | out: hFindFile=0xef02f8) returned 1 [0112.929] GetProcessHeap () returned 0xe70000 [0112.929] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0113.214] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0113.214] GetProcessHeap () returned 0xe70000 [0113.214] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0113.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef0178 [0113.220] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.220] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0113.220] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0113.221] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad2662, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad2662, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf971d6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0113.221] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x443f20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x443f20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0113.221] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0113.221] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0113.221] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d4bb8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d4bb8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d71cd8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0113.221] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf035e09d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf035e09d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x92201bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x97c9c99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd7bf89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb94fd84, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb94fd84, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb99c21f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c1f8d1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c1f8d1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c1f8d1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6034d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6034d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x605aed7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbe3ab3a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbe3ab3a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbe3ab3a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x70ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0113.222] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d9d08d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d9d08d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf755cb7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0113.223] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x456248c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0113.223] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e78ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e78ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e78ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0113.223] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0113.223] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0113.223] FindNextFileW (in: hFindFile=0xef0178, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0113.223] FindClose (in: hFindFile=0xef0178 | out: hFindFile=0xef0178) returned 1 [0113.225] GetProcessHeap () returned 0xe70000 [0113.226] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0113.226] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0113.226] GetProcessHeap () returned 0xe70000 [0113.226] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0113.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeefe38 [0113.228] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.228] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa39cfa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa39cfa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa39cfa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3143659, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbda21cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbda21cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbda21cf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa2f5c0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa2f5c0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa2f5c0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x20c030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4abf9f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0113.229] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1945af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1945af2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0113.230] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42d8c51, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0113.230] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0113.230] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e0ae4d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e0ae4d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e310c7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0113.230] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a2c10c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0113.230] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00af60a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0113.230] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6164f96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x75040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0113.231] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x384552e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x384552e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0113.231] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0113.231] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x605aed7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x605aed7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x613fd44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4640, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0113.231] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f2e583, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f2e583, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0113.231] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff580e7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0113.231] FindNextFileW (in: hFindFile=0xeefe38, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff580e7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0113.232] FindClose (in: hFindFile=0xeefe38 | out: hFindFile=0xeefe38) returned 1 [0113.234] GetProcessHeap () returned 0xe70000 [0113.234] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0113.234] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0113.234] GetProcessHeap () returned 0xe70000 [0113.234] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0113.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xef00b8 [0113.236] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.236] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1152, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0113.237] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x78b299, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x78b299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x78b299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0113.237] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cd5a2f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0113.237] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e7d566, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e7d566, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0113.237] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x200030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0113.237] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0113.237] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b9ee02, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7bc5054, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ca98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1dbe1c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1dbe1c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1dbe1c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12910b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12b7378, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5101cbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a04f26, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a04f26, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a04f26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0113.239] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff580e7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0063153, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0113.239] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0113.239] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c66c57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c66c57, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0113.239] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7bc5054, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7bc5054, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0113.239] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bce2f5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0113.239] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0113.240] FindNextFileW (in: hFindFile=0xef00b8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0113.240] FindClose (in: hFindFile=0xef00b8 | out: hFindFile=0xef00b8) returned 1 [0113.242] GetProcessHeap () returned 0xe70000 [0113.242] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x39408a0 | out: hHeap=0xe70000) returned 1 [0113.406] FindNextFileW (in: hFindFile=0xef0078, lpFindFileData=0x327e858 | out: lpFindFileData=0x327e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0113.406] GetProcessHeap () returned 0xe70000 [0113.406] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x39408a0 [0113.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\*", lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xeeffb8 [0113.409] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1095, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd7bf89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d2b978, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0113.410] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fe030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0113.410] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1697068, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0113.410] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0113.410] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d2b978, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0113.410] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5e43de4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5e43de4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6164f96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0113.410] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0113.411] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a0a7fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a0a7fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a30a43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0113.411] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0113.411] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69259a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69259a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0113.411] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6164f96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0113.411] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4110038, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4110038, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x447d6b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0113.411] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf126aeb1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf126aeb1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12b7378, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0113.412] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefe99511, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefebf763, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0113.412] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fa0ca2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fa0ca2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fa0ca2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0113.412] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0113.412] FindNextFileW (in: hFindFile=0xeeffb8, lpFindFileData=0x327e5c8 | out: lpFindFileData=0x327e5c8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0113.412] FindClose (hFindFile=0xeeffb8) Thread: id = 20 os_tid = 0xbfc [0090.392] GetLogicalDrives () returned 0x4 [0090.392] GetProcessHeap () returned 0xe70000 [0090.392] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe98130 [0090.392] GetProcessHeap () returned 0xe70000 [0090.392] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe98450 [0090.392] GetProcessHeap () returned 0xe70000 [0090.392] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe982c0 [0090.392] GetProcessHeap () returned 0xe70000 [0090.392] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe81e08 [0090.392] GetProcessHeap () returned 0xe70000 [0090.392] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe81e08 | out: hHeap=0xe70000) returned 1 [0090.392] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe98450, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0090.392] GetProcessHeap () returned 0xe70000 [0090.393] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe982c0 | out: hHeap=0xe70000) returned 1 [0090.393] GetProcessHeap () returned 0xe70000 [0090.393] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98130 | out: hHeap=0xe70000) returned 1 [0090.393] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x303f904, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x303f904*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0090.393] GetProcessHeap () returned 0xe70000 [0090.393] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98450 | out: hHeap=0xe70000) returned 1 [0090.394] GetProcessHeap () returned 0xe70000 [0090.395] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe829c8 [0090.395] GetProcessHeap () returned 0xe70000 [0090.395] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe9ada0 [0090.396] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2dc [0090.396] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e0 [0090.396] GetLogicalDrives () returned 0x4 [0090.396] Sleep (dwMilliseconds=0x3e8) [0091.892] GetLogicalDrives () returned 0x4 [0091.892] Sleep (dwMilliseconds=0x3e8) [0093.312] GetLogicalDrives () returned 0x4 [0093.313] Sleep (dwMilliseconds=0x3e8) [0094.567] GetLogicalDrives () returned 0x4 [0094.567] Sleep (dwMilliseconds=0x3e8) [0096.073] GetLogicalDrives () returned 0x4 [0096.073] Sleep (dwMilliseconds=0x3e8) [0097.442] GetLogicalDrives () returned 0x4 [0097.442] Sleep (dwMilliseconds=0x3e8) [0099.094] GetLogicalDrives () returned 0x4 [0099.094] Sleep (dwMilliseconds=0x3e8) [0100.404] GetLogicalDrives () returned 0x4 [0100.424] Sleep (dwMilliseconds=0x3e8) [0101.765] GetLogicalDrives () returned 0x4 [0101.773] Sleep (dwMilliseconds=0x3e8) [0104.750] GetLogicalDrives () returned 0x4 [0104.750] Sleep (dwMilliseconds=0x3e8) [0106.418] GetLogicalDrives () returned 0x4 [0106.418] Sleep (dwMilliseconds=0x3e8) [0107.958] GetLogicalDrives () returned 0x4 [0107.958] Sleep (dwMilliseconds=0x3e8) [0109.290] GetLogicalDrives () returned 0x4 [0109.290] Sleep (dwMilliseconds=0x3e8) [0110.677] GetLogicalDrives () returned 0x4 [0110.678] Sleep (dwMilliseconds=0x3e8) [0112.484] GetLogicalDrives () returned 0x4 [0112.484] Sleep (dwMilliseconds=0x3e8) Thread: id = 22 os_tid = 0xf5c [0090.640] GetProcessHeap () returned 0xe70000 [0090.640] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf24b98 [0091.052] GetProcessHeap () returned 0xe70000 [0091.052] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38e0870 [0091.053] GetProcessHeap () returned 0xe70000 [0091.053] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe9aec0 [0091.053] GetProcessHeap () returned 0xe70000 [0091.053] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x3be4020 [0091.060] GetProcessHeap () returned 0xe70000 [0091.060] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe98ce0 [0091.060] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0091.060] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0091.060] Wow64DisableWow64FsRedirection (in: OldValue=0x33bfa10 | out: OldValue=0x33bfa10*=0x0) returned 1 [0091.060] GetProcessHeap () returned 0xe70000 [0091.060] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98ce0 | out: hHeap=0xe70000) returned 1 [0091.060] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.061] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.061] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.061] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.061] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.061] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.061] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.062] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.062] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.062] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.062] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.062] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.063] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.063] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.063] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.063] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.063] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.064] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.064] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.064] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.064] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.064] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.065] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.065] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.065] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.065] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.065] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.066] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.066] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.067] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.067] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.067] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.067] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.067] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.068] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.068] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.068] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.068] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.068] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.069] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.069] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.069] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.069] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.069] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.070] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.070] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.070] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.070] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.070] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.071] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.071] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.071] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.071] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.072] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.072] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.072] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.072] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.073] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.073] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.073] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.073] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.073] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.073] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.074] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.074] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.074] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.074] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.075] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.075] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.075] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.075] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.075] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.076] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.076] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.076] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.076] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.077] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.077] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.077] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.077] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.078] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.078] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.078] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.078] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.078] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.078] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.079] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.079] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.079] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.079] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.080] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.080] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.080] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.080] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.080] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.081] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.081] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.081] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.081] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.348] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.348] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.349] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.349] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.349] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.349] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.350] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.350] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.350] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.350] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.350] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.351] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.351] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.351] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.351] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.352] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.352] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.352] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.352] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.352] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.353] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.353] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.353] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.353] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.353] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.354] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.354] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.354] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.354] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.355] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.355] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.355] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.355] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.355] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.356] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.356] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.356] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.356] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.356] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.357] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.357] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.357] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.357] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.358] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.358] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.358] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.358] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.358] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.359] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.359] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.359] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.359] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.360] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.360] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.360] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.360] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.360] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.361] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.361] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.361] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.361] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.362] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.362] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.362] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.362] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.363] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.363] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.363] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.363] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.363] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.364] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.364] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.364] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.364] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.364] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.365] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.365] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.365] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.365] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.366] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.366] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.366] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.366] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.366] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.367] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.367] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.367] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.367] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.368] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.368] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.368] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.368] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.368] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.369] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.369] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.369] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.369] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.370] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.370] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.370] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.370] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.370] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.371] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.371] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.371] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.371] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.371] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.372] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.372] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.372] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.372] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.372] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.373] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.373] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.373] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.373] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.374] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.374] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.374] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.374] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.374] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.375] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.375] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.375] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.375] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.375] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.376] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.376] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.376] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.376] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.376] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.377] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.377] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.377] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.377] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.378] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.378] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.379] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.379] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.380] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.380] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.380] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.380] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.380] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.381] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.381] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.381] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.381] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.382] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.382] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.891] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.891] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.891] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.891] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.891] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.892] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.893] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.894] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.896] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.897] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.899] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.901] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.902] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.905] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.907] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.908] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.909] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.909] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.909] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.909] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.909] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.909] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.911] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.912] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.914] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.916] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.918] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.919] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.920] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.921] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.922] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.923] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.924] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.925] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0092.925] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0101.236] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bf980 | out: lpNewFilePointer=0x0) returned 1 [0101.236] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bf980 | out: lpNewFilePointer=0x0) returned 1 [0101.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x330 [0101.237] ReadFile (in: hFile=0x32c, lpBuffer=0x3be4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x33bf994, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesRead=0x33bf994*=0x110100, lpOverlapped=0x0) returned 1 [0101.860] WriteFile (in: hFile=0x330, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x33bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf96c*=0x110100, lpOverlapped=0x0) returned 1 [0102.666] ReadFile (in: hFile=0x32c, lpBuffer=0x3be4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x33bf994, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesRead=0x33bf994*=0xedf00, lpOverlapped=0x0) returned 1 [0104.674] WriteFile (in: hFile=0x330, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0xedf10, lpNumberOfBytesWritten=0x33bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf96c*=0xedf10, lpOverlapped=0x0) returned 1 [0105.965] WriteFile (in: hFile=0x330, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf96c*=0xf2, lpOverlapped=0x0) returned 1 [0105.966] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bf6e0 | out: lpNewFilePointer=0x0) returned 1 [0105.966] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bf6e0 | out: lpNewFilePointer=0x0) returned 1 [0105.966] WriteFile (in: hFile=0x32c, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x33bf6ec, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf6ec*=0x110102, lpOverlapped=0x0) returned 1 [0106.469] WriteFile (in: hFile=0x32c, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0xedefe, lpNumberOfBytesWritten=0x33bf6ec, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf6ec*=0xedefe, lpOverlapped=0x0) returned 1 [0106.481] FlushFileBuffers (hFile=0x32c) returned 1 [0107.253] FlushFileBuffers (hFile=0x330) returned 1 [0107.568] CloseHandle (hObject=0x32c) returned 1 [0107.568] CloseHandle (hObject=0x330) returned 1 [0109.122] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde")) returned 1 [0109.408] ResetEvent (hEvent=0x2c0) returned 1 [0109.408] SetEvent (hEvent=0x2c4) returned 1 [0109.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0109.410] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33bf9b8 | out: lpFileSize=0x33bf9b8*=11493376) returned 1 [0109.410] CloseHandle (hObject=0x330) returned 1 [0109.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde")) returned 0x220 [0109.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde")) returned 0x220 [0109.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0109.411] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bf980 | out: lpNewFilePointer=0x0) returned 1 [0109.411] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bf980 | out: lpNewFilePointer=0x0) returned 1 [0109.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x318 [0109.412] ReadFile (in: hFile=0x330, lpBuffer=0x3be4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x33bf994, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesRead=0x33bf994*=0x110100, lpOverlapped=0x0) returned 1 [0109.884] WriteFile (in: hFile=0x318, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x33bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf96c*=0x110100, lpOverlapped=0x0) returned 1 [0110.590] ReadFile (in: hFile=0x330, lpBuffer=0x3be4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x33bf994, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesRead=0x33bf994*=0x110100, lpOverlapped=0x0) returned 1 [0111.332] WriteFile (in: hFile=0x318, lpBuffer=0x3be4020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x33bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesWritten=0x33bf96c*=0x110100, lpOverlapped=0x0) returned 1 [0112.348] ReadFile (in: hFile=0x330, lpBuffer=0x3be4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x33bf994, lpOverlapped=0x0 | out: lpBuffer=0x3be4020*, lpNumberOfBytesRead=0x33bf994*=0x110100, lpOverlapped=0x0) returned 1 [0112.660] WriteFile (hFile=0x318, lpBuffer=0x3be4020, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x33bf96c, lpOverlapped=0x0) Thread: id = 23 os_tid = 0x4e4 [0090.691] GetProcessHeap () returned 0xe70000 [0090.691] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf35270 [0090.692] GetProcessHeap () returned 0xe70000 [0090.692] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf45278 [0090.693] GetProcessHeap () returned 0xe70000 [0090.693] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe9ac50 [0090.693] GetProcessHeap () returned 0xe70000 [0090.693] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x378b020 [0090.701] GetProcessHeap () returned 0xe70000 [0090.701] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe99100 [0090.701] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0090.701] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0090.701] Wow64DisableWow64FsRedirection (in: OldValue=0x34ffe60 | out: OldValue=0x34ffe60*=0x0) returned 1 [0090.701] GetProcessHeap () returned 0xe70000 [0090.701] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe99100 | out: hHeap=0xe70000) returned 1 [0090.701] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.702] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.702] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.702] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.702] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.702] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.703] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.703] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.703] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.703] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.704] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.704] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.704] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.704] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.704] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.705] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.705] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.705] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.705] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.705] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.706] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.706] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.706] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.707] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.707] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.708] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.708] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.708] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.708] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.709] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.709] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.709] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.709] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.709] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.710] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.710] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.710] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.710] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.710] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.711] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.711] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.711] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.711] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.712] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.712] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.712] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.712] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.712] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.713] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.713] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.713] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.713] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.713] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.714] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.714] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.714] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.714] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.715] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.715] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.715] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.715] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.715] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.716] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.716] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.716] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.716] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.716] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.717] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.717] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.717] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.717] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.718] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.718] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.718] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.718] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.718] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.719] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.719] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.719] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.719] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.719] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.720] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.720] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.720] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.720] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.721] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.721] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.721] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.721] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.721] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.722] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.722] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.722] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.723] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.723] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.723] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.723] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.724] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.724] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.724] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.724] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.724] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.725] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.725] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.725] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.725] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.725] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.726] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.726] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.726] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.726] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.726] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.727] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.727] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.727] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.727] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.727] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.728] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.728] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.728] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.728] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.729] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.729] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.729] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.729] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.729] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.730] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.730] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.730] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.730] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.730] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.731] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.731] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.731] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.731] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.732] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.732] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.732] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.732] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.732] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.733] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.733] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.733] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.733] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.733] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.734] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.734] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.734] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.734] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.735] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.735] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.735] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.735] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.735] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.736] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.736] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.736] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.736] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.736] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.737] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.737] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.737] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0090.737] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.142] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.143] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.143] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.143] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.143] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.143] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.144] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.144] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.144] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.144] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.145] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.145] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.145] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.145] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.145] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.146] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.146] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.146] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.146] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.146] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.147] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.147] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.147] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.176] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.176] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.176] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.176] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.177] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.177] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.177] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.177] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.177] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.178] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.178] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.178] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.178] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.179] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.179] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.179] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.179] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.179] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.180] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.180] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.180] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.180] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.180] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.181] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.181] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.181] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.181] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.181] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.182] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.182] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.182] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.182] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.182] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.183] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.183] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.183] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.183] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.184] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.184] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.185] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.185] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.185] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.185] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.185] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.186] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.186] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.186] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.186] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.186] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.187] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.187] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.187] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.187] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.188] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.188] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.188] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.188] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.188] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.189] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.189] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.189] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.189] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0091.190] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0100.729] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffdd0 | out: lpNewFilePointer=0x0) returned 1 [0100.730] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffdd0 | out: lpNewFilePointer=0x0) returned 1 [0100.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x324 [0100.732] ReadFile (in: hFile=0x320, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x7c000, lpOverlapped=0x0) returned 1 [0101.066] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x7c010, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x7c010, lpOverlapped=0x0) returned 1 [0101.332] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0xf2, lpOverlapped=0x0) returned 1 [0101.332] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffb30 | out: lpNewFilePointer=0x0) returned 1 [0101.332] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffb30 | out: lpNewFilePointer=0x0) returned 1 [0101.332] WriteFile (in: hFile=0x320, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x7c000, lpNumberOfBytesWritten=0x34ffb3c, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffb3c*=0x7c000, lpOverlapped=0x0) returned 1 [0101.336] FlushFileBuffers (hFile=0x320) returned 1 [0101.346] FlushFileBuffers (hFile=0x324) returned 1 [0101.350] CloseHandle (hObject=0x320) returned 1 [0101.351] CloseHandle (hObject=0x324) returned 1 [0101.375] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb")) returned 1 [0101.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.608] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34ffe08 | out: lpFileSize=0x34ffe08*=9277440) returned 1 [0101.609] CloseHandle (hObject=0x328) returned 1 [0101.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 0x220 [0101.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 0x220 [0101.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.609] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffdd0 | out: lpNewFilePointer=0x0) returned 1 [0101.610] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffdd0 | out: lpNewFilePointer=0x0) returned 1 [0101.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x324 [0101.610] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0101.999] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0104.771] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0106.205] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0106.592] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0107.091] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0108.197] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0108.683] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0109.309] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0109.709] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0110.422] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0110.976] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0112.496] ReadFile (in: hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesRead=0x34ffde4*=0x110100, lpOverlapped=0x0) returned 1 [0112.950] WriteFile (in: hFile=0x324, lpBuffer=0x378b020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x34ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x378b020*, lpNumberOfBytesWritten=0x34ffdbc*=0x110100, lpOverlapped=0x0) returned 1 [0113.450] ReadFile (hFile=0x328, lpBuffer=0x378b020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x34ffde4, lpOverlapped=0x0) Thread: id = 24 os_tid = 0xcb8 [0090.785] GetProcessHeap () returned 0xe70000 [0090.785] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38b0858 [0090.786] GetProcessHeap () returned 0xe70000 [0090.786] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38c0860 [0090.787] GetProcessHeap () returned 0xe70000 [0090.787] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe9add0 [0090.787] GetProcessHeap () returned 0xe70000 [0090.787] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x3aca020 [0090.795] GetProcessHeap () returned 0xe70000 [0090.795] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe98ce0 [0090.795] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0090.795] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0090.795] Wow64DisableWow64FsRedirection (in: OldValue=0x363faf8 | out: OldValue=0x363faf8*=0x0) returned 1 [0090.795] GetProcessHeap () returned 0xe70000 [0090.795] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe98ce0 | out: hHeap=0xe70000) returned 1 [0090.796] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0090.798] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=6004) returned 1 [0090.798] CloseHandle (hObject=0x2fc) returned 1 [0090.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0090.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0090.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0090.799] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0090.799] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0090.799] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0090.799] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0090.800] ReadFile (in: hFile=0x2fc, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1774, lpOverlapped=0x0) returned 1 [0091.249] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x1780, lpOverlapped=0x0) returned 1 [0091.711] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x122, lpOverlapped=0x0) returned 1 [0091.712] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0091.712] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0091.712] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1774, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1774, lpOverlapped=0x0) returned 1 [0091.713] FlushFileBuffers (hFile=0x2fc) returned 1 [0092.106] FlushFileBuffers (hFile=0x300) returned 1 [0092.110] CloseHandle (hObject=0x2fc) returned 1 [0092.124] CloseHandle (hObject=0x300) returned 1 [0092.125] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0092.130] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0092.130] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=40) returned 1 [0092.130] CloseHandle (hObject=0x300) returned 1 [0092.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0092.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0092.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0092.131] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0092.131] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0092.132] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0092.132] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0092.132] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x28, lpOverlapped=0x0) returned 1 [0092.135] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x30, lpOverlapped=0x0) returned 1 [0092.138] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x112, lpOverlapped=0x0) returned 1 [0092.138] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0092.138] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0092.138] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x28, lpOverlapped=0x0) returned 1 [0092.138] FlushFileBuffers (hFile=0x300) returned 1 [0092.148] FlushFileBuffers (hFile=0x2fc) returned 1 [0092.153] CloseHandle (hObject=0x300) returned 1 [0092.155] CloseHandle (hObject=0x2fc) returned 1 [0092.155] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0092.158] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0092.167] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=144072) returned 1 [0092.167] CloseHandle (hObject=0x2fc) returned 1 [0092.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0092.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0092.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0092.168] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0092.168] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0092.168] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0092.168] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0092.169] ReadFile (in: hFile=0x2fc, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x232c8, lpOverlapped=0x0) returned 1 [0092.178] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x232d0, lpOverlapped=0x0) returned 1 [0092.187] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0092.187] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0092.187] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0092.187] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x232c8, lpOverlapped=0x0) returned 1 [0092.189] FlushFileBuffers (hFile=0x2fc) returned 1 [0093.060] FlushFileBuffers (hFile=0x300) returned 1 [0093.066] CloseHandle (hObject=0x2fc) returned 1 [0093.072] CloseHandle (hObject=0x300) returned 1 [0093.080] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0093.085] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.085] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=129) returned 1 [0093.085] CloseHandle (hObject=0x300) returned 1 [0093.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0093.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0093.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0093.086] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.086] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.086] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.086] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x2fc [0093.089] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x81, lpOverlapped=0x0) returned 1 [0093.091] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x90, lpOverlapped=0x0) returned 1 [0093.094] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0093.094] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.095] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.095] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x81, lpOverlapped=0x0) returned 1 [0093.095] FlushFileBuffers (hFile=0x300) returned 1 [0093.102] FlushFileBuffers (hFile=0x2fc) returned 1 [0093.107] CloseHandle (hObject=0x300) returned 1 [0093.125] CloseHandle (hObject=0x2fc) returned 1 [0093.129] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0093.132] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0093.132] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=129) returned 1 [0093.132] CloseHandle (hObject=0x2fc) returned 1 [0093.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0093.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0093.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0093.133] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0093.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.134] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x300 [0093.135] ReadFile (in: hFile=0x2fc, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x81, lpOverlapped=0x0) returned 1 [0093.137] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x90, lpOverlapped=0x0) returned 1 [0093.139] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0093.140] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.140] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.140] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x81, lpOverlapped=0x0) returned 1 [0093.140] FlushFileBuffers (hFile=0x2fc) returned 1 [0093.156] FlushFileBuffers (hFile=0x300) returned 1 [0093.162] CloseHandle (hObject=0x2fc) returned 1 [0093.162] CloseHandle (hObject=0x300) returned 1 [0093.170] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0093.173] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.178] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=0) returned 1 [0093.178] CloseHandle (hObject=0x300) returned 1 [0093.178] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.180] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=7567) returned 1 [0093.180] CloseHandle (hObject=0x300) returned 1 [0093.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0093.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0093.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0093.181] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.181] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.181] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.182] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2fc [0093.185] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1d8f, lpOverlapped=0x0) returned 1 [0093.190] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x1d90, lpOverlapped=0x0) returned 1 [0093.194] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0093.194] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.194] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.194] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1d8f, lpOverlapped=0x0) returned 1 [0093.194] FlushFileBuffers (hFile=0x300) returned 1 [0093.199] FlushFileBuffers (hFile=0x2fc) returned 1 [0093.202] CloseHandle (hObject=0x300) returned 1 [0093.204] CloseHandle (hObject=0x2fc) returned 1 [0093.209] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0093.212] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0093.212] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=74214) returned 1 [0093.212] CloseHandle (hObject=0x2fc) returned 1 [0093.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0093.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0093.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0093.213] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0093.213] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.213] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0093.213] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0093.213] ReadFile (in: hFile=0x2fc, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x121e6, lpOverlapped=0x0) returned 1 [0093.219] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x121f0, lpOverlapped=0x0) returned 1 [0093.232] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0093.232] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.232] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0093.233] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x121e6, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x121e6, lpOverlapped=0x0) returned 1 [0093.233] FlushFileBuffers (hFile=0x2fc) returned 1 [0093.973] FlushFileBuffers (hFile=0x300) returned 1 [0094.660] CloseHandle (hObject=0x2fc) returned 1 [0094.665] CloseHandle (hObject=0x300) returned 1 [0094.669] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0094.673] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.674] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=6309) returned 1 [0094.674] CloseHandle (hObject=0x300) returned 1 [0094.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0094.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0094.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0094.674] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.674] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0094.675] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0094.675] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2fc [0094.679] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x18a5, lpOverlapped=0x0) returned 1 [0094.683] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x18b0, lpOverlapped=0x0) returned 1 [0094.686] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0094.686] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0094.686] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0094.687] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x18a5, lpOverlapped=0x0) returned 1 [0094.687] FlushFileBuffers (hFile=0x300) returned 1 [0094.693] FlushFileBuffers (hFile=0x2fc) returned 1 [0094.696] CloseHandle (hObject=0x300) returned 1 [0094.708] CloseHandle (hObject=0x2fc) returned 1 [0094.712] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0094.715] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0094.715] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=60816) returned 1 [0094.715] CloseHandle (hObject=0x2fc) returned 1 [0094.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0094.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0094.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0094.716] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0094.716] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0094.716] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0094.716] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0094.716] ReadFile (in: hFile=0x2fc, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xed90, lpOverlapped=0x0) returned 1 [0094.722] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xeda0, lpOverlapped=0x0) returned 1 [0094.727] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0094.727] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0094.727] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0094.727] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xed90, lpOverlapped=0x0) returned 1 [0094.728] FlushFileBuffers (hFile=0x2fc) returned 1 [0095.131] FlushFileBuffers (hFile=0x300) returned 1 [0095.133] CloseHandle (hObject=0x2fc) returned 1 [0095.137] CloseHandle (hObject=0x300) returned 1 [0095.140] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0095.147] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0095.148] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3726) returned 1 [0095.148] CloseHandle (hObject=0x300) returned 1 [0095.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0095.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0095.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.148] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0095.149] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0095.149] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0095.149] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2fc [0095.152] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xe8e, lpOverlapped=0x0) returned 1 [0095.155] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xe90, lpOverlapped=0x0) returned 1 [0095.158] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0095.158] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0095.158] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0095.158] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xe8e, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xe8e, lpOverlapped=0x0) returned 1 [0095.159] FlushFileBuffers (hFile=0x300) returned 1 [0095.461] FlushFileBuffers (hFile=0x2fc) returned 1 [0095.464] CloseHandle (hObject=0x300) returned 1 [0095.465] CloseHandle (hObject=0x2fc) returned 1 [0095.466] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0095.469] SetEvent (hEvent=0x2b0) returned 1 [0095.470] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0095.470] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=18264) returned 1 [0095.470] CloseHandle (hObject=0x2fc) returned 1 [0095.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0095.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0095.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.471] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0095.471] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0095.471] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0095.471] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0095.472] ReadFile (in: hFile=0x2fc, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4758, lpOverlapped=0x0) returned 1 [0095.482] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4760, lpOverlapped=0x0) returned 1 [0095.486] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0095.487] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0095.487] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0095.487] WriteFile (in: hFile=0x2fc, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4758, lpOverlapped=0x0) returned 1 [0095.487] FlushFileBuffers (hFile=0x2fc) returned 1 [0095.846] FlushFileBuffers (hFile=0x300) returned 1 [0095.849] CloseHandle (hObject=0x2fc) returned 1 [0095.851] CloseHandle (hObject=0x300) returned 1 [0095.853] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0095.856] SetEvent (hEvent=0x2b0) returned 1 [0095.856] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0095.870] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=18264) returned 1 [0095.870] CloseHandle (hObject=0x318) returned 1 [0095.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0095.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0095.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.871] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0095.871] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0095.871] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0095.871] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0095.871] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4758, lpOverlapped=0x0) returned 1 [0095.876] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4760, lpOverlapped=0x0) returned 1 [0095.879] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0095.879] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0095.879] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0095.880] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4758, lpOverlapped=0x0) returned 1 [0095.880] FlushFileBuffers (hFile=0x318) returned 1 [0096.003] FlushFileBuffers (hFile=0x300) returned 1 [0096.007] CloseHandle (hObject=0x318) returned 1 [0096.008] CloseHandle (hObject=0x300) returned 1 [0096.010] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0096.012] SetEvent (hEvent=0x2b0) returned 1 [0096.013] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0096.015] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=8876) returned 1 [0096.015] CloseHandle (hObject=0x300) returned 1 [0096.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0096.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0096.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0096.015] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0096.016] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.016] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.016] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0096.019] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x22ac, lpOverlapped=0x0) returned 1 [0096.024] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x22b0, lpOverlapped=0x0) returned 1 [0096.026] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0096.027] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.027] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.027] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x22ac, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x22ac, lpOverlapped=0x0) returned 1 [0096.027] FlushFileBuffers (hFile=0x300) returned 1 [0096.032] FlushFileBuffers (hFile=0x318) returned 1 [0096.036] CloseHandle (hObject=0x300) returned 1 [0096.040] CloseHandle (hObject=0x318) returned 1 [0096.044] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0096.048] SetEvent (hEvent=0x2b0) returned 1 [0096.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.048] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=86284) returned 1 [0096.049] CloseHandle (hObject=0x318) returned 1 [0096.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0096.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0096.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0096.049] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.050] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.050] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.050] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0096.050] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1510c, lpOverlapped=0x0) returned 1 [0096.057] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x15110, lpOverlapped=0x0) returned 1 [0096.064] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0096.066] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.066] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.066] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1510c, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1510c, lpOverlapped=0x0) returned 1 [0096.067] FlushFileBuffers (hFile=0x318) returned 1 [0096.697] FlushFileBuffers (hFile=0x300) returned 1 [0096.703] CloseHandle (hObject=0x318) returned 1 [0096.709] CloseHandle (hObject=0x300) returned 1 [0096.713] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0096.717] SetEvent (hEvent=0x2b0) returned 1 [0096.718] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0096.718] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3188) returned 1 [0096.718] CloseHandle (hObject=0x300) returned 1 [0096.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0096.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0096.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0096.719] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0096.719] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.719] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.720] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0096.724] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xc74, lpOverlapped=0x0) returned 1 [0096.728] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xc80, lpOverlapped=0x0) returned 1 [0096.730] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0096.731] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.731] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.731] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xc74, lpOverlapped=0x0) returned 1 [0096.731] FlushFileBuffers (hFile=0x300) returned 1 [0096.737] FlushFileBuffers (hFile=0x318) returned 1 [0096.740] CloseHandle (hObject=0x300) returned 1 [0096.741] CloseHandle (hObject=0x318) returned 1 [0096.744] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0096.747] SetEvent (hEvent=0x2b0) returned 1 [0096.747] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.747] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=77232) returned 1 [0096.748] CloseHandle (hObject=0x318) returned 1 [0096.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0096.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0096.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0096.748] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.748] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.749] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0096.749] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0096.749] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x12db0, lpOverlapped=0x0) returned 1 [0096.755] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x12dc0, lpOverlapped=0x0) returned 1 [0096.760] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0096.760] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.761] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0096.761] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x12db0, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x12db0, lpOverlapped=0x0) returned 1 [0096.762] FlushFileBuffers (hFile=0x318) returned 1 [0097.074] FlushFileBuffers (hFile=0x300) returned 1 [0097.077] CloseHandle (hObject=0x318) returned 1 [0097.082] CloseHandle (hObject=0x300) returned 1 [0097.087] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0097.091] SetEvent (hEvent=0x2b0) returned 1 [0097.091] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0097.092] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3702) returned 1 [0097.092] CloseHandle (hObject=0x300) returned 1 [0097.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0097.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0097.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0097.093] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0097.093] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0097.093] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0097.093] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0097.098] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xe76, lpOverlapped=0x0) returned 1 [0097.102] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xe80, lpOverlapped=0x0) returned 1 [0097.105] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0097.106] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0097.106] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0097.106] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xe76, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xe76, lpOverlapped=0x0) returned 1 [0097.106] FlushFileBuffers (hFile=0x300) returned 1 [0097.111] FlushFileBuffers (hFile=0x318) returned 1 [0097.114] CloseHandle (hObject=0x300) returned 1 [0097.115] CloseHandle (hObject=0x318) returned 1 [0097.116] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0097.119] SetEvent (hEvent=0x2b0) returned 1 [0097.119] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.119] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=77022) returned 1 [0097.120] CloseHandle (hObject=0x318) returned 1 [0097.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0097.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0097.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0097.120] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.120] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0097.121] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0097.121] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0097.121] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x12cde, lpOverlapped=0x0) returned 1 [0097.138] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x12ce0, lpOverlapped=0x0) returned 1 [0097.145] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0097.145] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0097.146] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0097.146] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x12cde, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x12cde, lpOverlapped=0x0) returned 1 [0097.147] FlushFileBuffers (hFile=0x318) returned 1 [0098.118] FlushFileBuffers (hFile=0x300) returned 1 [0098.122] CloseHandle (hObject=0x318) returned 1 [0098.134] CloseHandle (hObject=0x300) returned 1 [0098.138] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0098.142] SetEvent (hEvent=0x2b0) returned 1 [0098.143] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0098.143] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3526) returned 1 [0098.143] CloseHandle (hObject=0x300) returned 1 [0098.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0098.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0098.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0098.144] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0098.144] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0098.144] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0098.144] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0098.148] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xdc6, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xdd0, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0098.154] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0098.154] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xdc6, lpOverlapped=0x0) returned 1 [0098.155] FlushFileBuffers (hFile=0x300) returned 1 [0098.163] FlushFileBuffers (hFile=0x318) returned 1 [0098.166] CloseHandle (hObject=0x300) returned 1 [0098.167] CloseHandle (hObject=0x318) returned 1 [0098.168] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0098.170] SetEvent (hEvent=0x2b0) returned 1 [0098.170] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0098.171] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=82962) returned 1 [0098.171] CloseHandle (hObject=0x318) returned 1 [0098.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0098.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0098.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0098.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0098.172] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0098.172] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0098.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0098.173] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x14412, lpOverlapped=0x0) returned 1 [0098.180] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x14420, lpOverlapped=0x0) returned 1 [0098.186] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0098.186] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0098.187] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0098.187] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x14412, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x14412, lpOverlapped=0x0) returned 1 [0098.187] FlushFileBuffers (hFile=0x318) returned 1 [0098.700] FlushFileBuffers (hFile=0x300) returned 1 [0099.487] CloseHandle (hObject=0x318) returned 1 [0099.494] CloseHandle (hObject=0x300) returned 1 [0099.499] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0099.503] SetEvent (hEvent=0x2b0) returned 1 [0099.504] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0099.504] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=6851) returned 1 [0099.505] CloseHandle (hObject=0x300) returned 1 [0099.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0099.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0099.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0099.505] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0099.505] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0099.506] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0099.506] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0099.510] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1ac3, lpOverlapped=0x0) returned 1 [0099.514] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x1ad0, lpOverlapped=0x0) returned 1 [0099.517] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0099.518] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0099.518] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0099.518] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1ac3, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1ac3, lpOverlapped=0x0) returned 1 [0099.518] FlushFileBuffers (hFile=0x300) returned 1 [0099.523] FlushFileBuffers (hFile=0x318) returned 1 [0099.526] CloseHandle (hObject=0x300) returned 1 [0099.528] CloseHandle (hObject=0x318) returned 1 [0099.529] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0099.531] SetEvent (hEvent=0x2b0) returned 1 [0099.532] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.533] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=72076) returned 1 [0099.533] CloseHandle (hObject=0x318) returned 1 [0099.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0099.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0099.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0099.534] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.534] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0099.534] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0099.534] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0099.535] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1198c, lpOverlapped=0x0) returned 1 [0099.540] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x11990, lpOverlapped=0x0) returned 1 [0099.546] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0099.546] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0099.547] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0099.547] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1198c, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1198c, lpOverlapped=0x0) returned 1 [0099.547] FlushFileBuffers (hFile=0x318) returned 1 [0099.810] FlushFileBuffers (hFile=0x300) returned 1 [0100.184] CloseHandle (hObject=0x318) returned 1 [0100.187] CloseHandle (hObject=0x300) returned 1 [0100.191] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0100.195] SetEvent (hEvent=0x2b0) returned 1 [0100.195] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0100.197] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=16728) returned 1 [0100.197] CloseHandle (hObject=0x300) returned 1 [0100.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0100.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0100.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0100.198] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0100.198] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0100.198] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0100.198] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0100.198] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4158, lpOverlapped=0x0) returned 1 [0100.203] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4160, lpOverlapped=0x0) returned 1 [0100.207] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0100.208] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0100.208] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0100.208] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4158, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4158, lpOverlapped=0x0) returned 1 [0100.370] FlushFileBuffers (hFile=0x300) returned 1 [0100.844] FlushFileBuffers (hFile=0x318) returned 1 [0100.934] CloseHandle (hObject=0x300) returned 1 [0100.936] CloseHandle (hObject=0x318) returned 1 [0100.938] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0100.941] SetEvent (hEvent=0x2b0) returned 1 [0100.941] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.944] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=18776) returned 1 [0100.944] CloseHandle (hObject=0x318) returned 1 [0100.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0100.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0100.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0100.944] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.944] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0100.945] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0100.945] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0100.945] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4958, lpOverlapped=0x0) returned 1 [0100.950] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4960, lpOverlapped=0x0) returned 1 [0100.954] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0100.954] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0100.954] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0100.955] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4958, lpOverlapped=0x0) returned 1 [0100.955] FlushFileBuffers (hFile=0x318) returned 1 [0101.140] FlushFileBuffers (hFile=0x300) returned 1 [0101.147] CloseHandle (hObject=0x318) returned 1 [0101.149] CloseHandle (hObject=0x300) returned 1 [0101.151] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0101.154] SetEvent (hEvent=0x2b0) returned 1 [0101.154] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0101.155] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=80060) returned 1 [0101.155] CloseHandle (hObject=0x300) returned 1 [0101.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0101.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0101.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.156] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0101.156] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0101.156] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0101.156] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0101.156] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x138bc, lpOverlapped=0x0) returned 1 [0101.178] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x138c0, lpOverlapped=0x0) returned 1 [0101.185] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0101.185] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0101.186] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0101.186] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x138bc, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x138bc, lpOverlapped=0x0) returned 1 [0101.186] FlushFileBuffers (hFile=0x300) returned 1 [0101.437] FlushFileBuffers (hFile=0x318) returned 1 [0101.440] CloseHandle (hObject=0x300) returned 1 [0101.444] CloseHandle (hObject=0x318) returned 1 [0101.448] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0101.452] SetEvent (hEvent=0x2b0) returned 1 [0101.452] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.452] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=10125) returned 1 [0101.453] CloseHandle (hObject=0x318) returned 1 [0101.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0101.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0101.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.453] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.453] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0101.453] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0101.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0101.468] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x278d, lpOverlapped=0x0) returned 1 [0101.472] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x2790, lpOverlapped=0x0) returned 1 [0101.474] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0101.475] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0101.475] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0101.475] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x278d, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x278d, lpOverlapped=0x0) returned 1 [0101.475] FlushFileBuffers (hFile=0x318) returned 1 [0102.476] FlushFileBuffers (hFile=0x300) returned 1 [0102.484] CloseHandle (hObject=0x318) returned 1 [0102.485] CloseHandle (hObject=0x300) returned 1 [0102.486] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0102.491] SetEvent (hEvent=0x2b0) returned 1 [0102.492] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0102.492] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=12687) returned 1 [0102.492] CloseHandle (hObject=0x300) returned 1 [0102.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0102.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0102.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0102.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0102.493] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0102.493] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0102.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0102.502] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x318f, lpOverlapped=0x0) returned 1 [0102.514] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x3190, lpOverlapped=0x0) returned 1 [0102.517] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0102.517] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0102.517] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0102.518] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x318f, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x318f, lpOverlapped=0x0) returned 1 [0102.518] FlushFileBuffers (hFile=0x300) returned 1 [0102.523] FlushFileBuffers (hFile=0x318) returned 1 [0102.527] CloseHandle (hObject=0x300) returned 1 [0102.532] CloseHandle (hObject=0x318) returned 1 [0102.536] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0102.539] SetEvent (hEvent=0x2b0) returned 1 [0102.539] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.539] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=65238) returned 1 [0102.539] CloseHandle (hObject=0x318) returned 1 [0102.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0102.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0102.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0102.540] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.540] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0102.540] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0102.540] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0102.541] ReadFile (in: hFile=0x318, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xfed6, lpOverlapped=0x0) returned 1 [0102.550] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xfee0, lpOverlapped=0x0) returned 1 [0102.554] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0102.555] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0102.555] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0102.555] WriteFile (in: hFile=0x318, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xfed6, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xfed6, lpOverlapped=0x0) returned 1 [0102.556] FlushFileBuffers (hFile=0x318) returned 1 [0105.078] FlushFileBuffers (hFile=0x300) returned 1 [0105.085] CloseHandle (hObject=0x318) returned 1 [0105.088] CloseHandle (hObject=0x300) returned 1 [0105.092] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0105.096] SetEvent (hEvent=0x2b0) returned 1 [0105.096] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0105.099] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3546) returned 1 [0105.099] CloseHandle (hObject=0x300) returned 1 [0105.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0105.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0105.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0105.099] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0105.100] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0105.100] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0105.100] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0105.110] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xdda, lpOverlapped=0x0) returned 1 [0105.118] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xde0, lpOverlapped=0x0) returned 1 [0105.121] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0105.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0105.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0105.121] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xdda, lpOverlapped=0x0) returned 1 [0105.122] FlushFileBuffers (hFile=0x300) returned 1 [0105.161] FlushFileBuffers (hFile=0x2ac) returned 1 [0105.164] CloseHandle (hObject=0x300) returned 1 [0105.165] CloseHandle (hObject=0x2ac) returned 1 [0105.166] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0105.168] SetEvent (hEvent=0x2b0) returned 1 [0105.169] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0105.170] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=19288) returned 1 [0105.170] CloseHandle (hObject=0x2ac) returned 1 [0105.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0105.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0105.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0105.171] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0105.171] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0105.171] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0105.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0105.172] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4b58, lpOverlapped=0x0) returned 1 [0105.178] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4b60, lpOverlapped=0x0) returned 1 [0105.181] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0105.181] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0105.181] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0105.181] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4b58, lpOverlapped=0x0) returned 1 [0105.182] FlushFileBuffers (hFile=0x2ac) returned 1 [0106.262] FlushFileBuffers (hFile=0x300) returned 1 [0106.270] CloseHandle (hObject=0x2ac) returned 1 [0106.272] CloseHandle (hObject=0x300) returned 1 [0106.273] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0106.276] SetEvent (hEvent=0x2b0) returned 1 [0106.277] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0106.277] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=17752) returned 1 [0106.277] CloseHandle (hObject=0x300) returned 1 [0106.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0106.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0106.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0106.278] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0106.278] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0106.278] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0106.278] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0106.279] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4558, lpOverlapped=0x0) returned 1 [0106.290] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4560, lpOverlapped=0x0) returned 1 [0106.293] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0106.294] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0106.294] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0106.294] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4558, lpOverlapped=0x0) returned 1 [0106.294] FlushFileBuffers (hFile=0x300) returned 1 [0106.659] FlushFileBuffers (hFile=0x2ac) returned 1 [0106.706] CloseHandle (hObject=0x300) returned 1 [0106.707] CloseHandle (hObject=0x2ac) returned 1 [0106.709] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0106.712] SetEvent (hEvent=0x2b0) returned 1 [0106.712] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0106.712] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3683) returned 1 [0106.712] CloseHandle (hObject=0x2ac) returned 1 [0106.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0106.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0106.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0106.713] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0106.713] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0106.713] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0106.713] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0106.719] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xe63, lpOverlapped=0x0) returned 1 [0106.725] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xe70, lpOverlapped=0x0) returned 1 [0106.728] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0106.728] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0106.729] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0106.729] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xe63, lpOverlapped=0x0) returned 1 [0106.729] FlushFileBuffers (hFile=0x2ac) returned 1 [0106.733] FlushFileBuffers (hFile=0x300) returned 1 [0106.736] CloseHandle (hObject=0x2ac) returned 1 [0106.738] CloseHandle (hObject=0x300) returned 1 [0106.739] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0106.741] SetEvent (hEvent=0x2b0) returned 1 [0106.741] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0106.742] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=80738) returned 1 [0106.742] CloseHandle (hObject=0x300) returned 1 [0106.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0106.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0106.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0106.742] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0106.742] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0106.743] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0106.743] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0106.743] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x13b62, lpOverlapped=0x0) returned 1 [0106.748] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x13b70, lpOverlapped=0x0) returned 1 [0106.761] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0106.761] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0106.762] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0106.762] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x13b62, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x13b62, lpOverlapped=0x0) returned 1 [0106.762] FlushFileBuffers (hFile=0x300) returned 1 [0107.611] FlushFileBuffers (hFile=0x2ac) returned 1 [0108.755] CloseHandle (hObject=0x300) returned 1 [0108.760] CloseHandle (hObject=0x2ac) returned 1 [0108.782] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0108.785] SetEvent (hEvent=0x2b0) returned 1 [0108.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0108.786] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=18264) returned 1 [0108.787] CloseHandle (hObject=0x2ac) returned 1 [0108.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0108.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0108.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0108.787] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0108.787] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0108.788] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0108.795] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0108.796] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4758, lpOverlapped=0x0) returned 1 [0109.177] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4760, lpOverlapped=0x0) returned 1 [0109.181] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0109.181] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.181] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.182] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4758, lpOverlapped=0x0) returned 1 [0109.182] FlushFileBuffers (hFile=0x2ac) returned 1 [0109.453] FlushFileBuffers (hFile=0x300) returned 1 [0109.480] CloseHandle (hObject=0x2ac) returned 1 [0109.481] CloseHandle (hObject=0x300) returned 1 [0109.483] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0109.486] SetEvent (hEvent=0x2b0) returned 1 [0109.487] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0109.487] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3865) returned 1 [0109.487] CloseHandle (hObject=0x300) returned 1 [0109.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0109.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0109.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.488] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0109.488] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.488] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.488] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0109.492] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xf19, lpOverlapped=0x0) returned 1 [0109.495] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf20, lpOverlapped=0x0) returned 1 [0109.497] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0109.497] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.498] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.498] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf19, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xf19, lpOverlapped=0x0) returned 1 [0109.498] FlushFileBuffers (hFile=0x300) returned 1 [0109.503] FlushFileBuffers (hFile=0x2ac) returned 1 [0109.505] CloseHandle (hObject=0x300) returned 1 [0109.506] CloseHandle (hObject=0x2ac) returned 1 [0109.508] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0109.510] SetEvent (hEvent=0x2b0) returned 1 [0109.510] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0109.511] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=77680) returned 1 [0109.511] CloseHandle (hObject=0x2ac) returned 1 [0109.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0109.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0109.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.511] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0109.512] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.512] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.512] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0109.512] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x12f70, lpOverlapped=0x0) returned 1 [0109.518] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x12f80, lpOverlapped=0x0) returned 1 [0109.523] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0109.523] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.523] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.524] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x12f70, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x12f70, lpOverlapped=0x0) returned 1 [0109.524] FlushFileBuffers (hFile=0x2ac) returned 1 [0109.539] FlushFileBuffers (hFile=0x300) returned 1 [0109.542] CloseHandle (hObject=0x2ac) returned 1 [0109.546] CloseHandle (hObject=0x300) returned 1 [0109.550] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0109.553] SetEvent (hEvent=0x2b0) returned 1 [0109.554] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0109.554] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=17752) returned 1 [0109.554] CloseHandle (hObject=0x300) returned 1 [0109.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0109.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0109.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.555] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0109.555] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.555] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.555] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0109.555] ReadFile (in: hFile=0x300, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4558, lpOverlapped=0x0) returned 1 [0109.561] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4560, lpOverlapped=0x0) returned 1 [0109.564] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0109.564] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.564] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.565] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4558, lpOverlapped=0x0) returned 1 [0109.565] FlushFileBuffers (hFile=0x300) returned 1 [0109.905] FlushFileBuffers (hFile=0x2ac) returned 1 [0109.910] CloseHandle (hObject=0x300) returned 1 [0109.912] CloseHandle (hObject=0x2ac) returned 1 [0109.916] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0109.919] SetEvent (hEvent=0x2b0) returned 1 [0109.919] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0109.919] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=17752) returned 1 [0109.919] CloseHandle (hObject=0x2ac) returned 1 [0109.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0109.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0109.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.920] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0109.920] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.920] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0109.920] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0109.921] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x4558, lpOverlapped=0x0) returned 1 [0109.925] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x4560, lpOverlapped=0x0) returned 1 [0109.928] WriteFile (in: hFile=0x300, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0109.928] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.928] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0109.928] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x4558, lpOverlapped=0x0) returned 1 [0109.929] FlushFileBuffers (hFile=0x2ac) returned 1 [0110.273] FlushFileBuffers (hFile=0x300) returned 1 [0110.284] CloseHandle (hObject=0x2ac) returned 1 [0110.285] CloseHandle (hObject=0x300) returned 1 [0110.288] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0110.308] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0110.308] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=14168) returned 1 [0110.308] CloseHandle (hObject=0x304) returned 1 [0110.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0110.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0110.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0110.309] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0110.309] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0110.309] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0110.309] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0110.310] ReadFile (in: hFile=0x304, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x3758, lpOverlapped=0x0) returned 1 [0110.318] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x3760, lpOverlapped=0x0) returned 1 [0110.321] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0110.322] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0110.322] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0110.322] WriteFile (in: hFile=0x304, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x3758, lpOverlapped=0x0) returned 1 [0110.322] FlushFileBuffers (hFile=0x304) returned 1 [0110.750] FlushFileBuffers (hFile=0x314) returned 1 [0110.758] CloseHandle (hObject=0x304) returned 1 [0110.759] CloseHandle (hObject=0x314) returned 1 [0110.772] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0110.783] SetEvent (hEvent=0x2b0) returned 1 [0110.783] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.784] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=80254) returned 1 [0110.784] CloseHandle (hObject=0x314) returned 1 [0110.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0110.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0110.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0110.785] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.785] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0110.785] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0110.785] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0110.799] ReadFile (in: hFile=0x314, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1397e, lpOverlapped=0x0) returned 1 [0111.355] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x13980, lpOverlapped=0x0) returned 1 [0111.360] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0111.361] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.361] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.361] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1397e, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1397e, lpOverlapped=0x0) returned 1 [0111.361] FlushFileBuffers (hFile=0x314) returned 1 [0111.378] FlushFileBuffers (hFile=0x2ac) returned 1 [0111.396] CloseHandle (hObject=0x314) returned 1 [0111.401] CloseHandle (hObject=0x2ac) returned 1 [0111.406] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0111.409] SetEvent (hEvent=0x2b0) returned 1 [0111.409] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0111.410] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=60816) returned 1 [0111.410] CloseHandle (hObject=0x2ac) returned 1 [0111.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0111.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0111.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0111.411] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0111.411] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0111.411] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0111.411] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0111.411] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xed90, lpOverlapped=0x0) returned 1 [0111.423] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xeda0, lpOverlapped=0x0) returned 1 [0111.428] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0111.428] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.428] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.428] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xed90, lpOverlapped=0x0) returned 1 [0111.429] FlushFileBuffers (hFile=0x2ac) returned 1 [0111.448] FlushFileBuffers (hFile=0x314) returned 1 [0111.467] CloseHandle (hObject=0x2ac) returned 1 [0111.470] CloseHandle (hObject=0x314) returned 1 [0111.473] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0111.477] SetEvent (hEvent=0x2b0) returned 1 [0111.477] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.478] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=3069) returned 1 [0111.479] CloseHandle (hObject=0x314) returned 1 [0111.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0111.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0111.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0111.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.479] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0111.480] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0111.480] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0111.483] ReadFile (in: hFile=0x314, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0xbfd, lpOverlapped=0x0) returned 1 [0111.487] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xc00, lpOverlapped=0x0) returned 1 [0111.489] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0111.489] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.489] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.489] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xbfd, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0xbfd, lpOverlapped=0x0) returned 1 [0111.489] FlushFileBuffers (hFile=0x314) returned 1 [0111.496] FlushFileBuffers (hFile=0x2ac) returned 1 [0111.499] CloseHandle (hObject=0x314) returned 1 [0111.500] CloseHandle (hObject=0x2ac) returned 1 [0111.504] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0111.506] SetEvent (hEvent=0x2b0) returned 1 [0111.507] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0111.507] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=79996) returned 1 [0111.507] CloseHandle (hObject=0x2ac) returned 1 [0111.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0111.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0111.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0111.509] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0111.509] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0111.509] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0111.509] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0111.510] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x1387c, lpOverlapped=0x0) returned 1 [0111.516] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x13880, lpOverlapped=0x0) returned 1 [0111.521] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0111.522] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.522] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0111.522] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x1387c, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x1387c, lpOverlapped=0x0) returned 1 [0111.523] FlushFileBuffers (hFile=0x2ac) returned 1 [0112.399] FlushFileBuffers (hFile=0x314) returned 1 [0112.402] CloseHandle (hObject=0x2ac) returned 1 [0112.409] CloseHandle (hObject=0x314) returned 1 [0112.416] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0112.420] SetEvent (hEvent=0x2b0) returned 1 [0112.420] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0112.420] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=201796) returned 1 [0112.420] CloseHandle (hObject=0x314) returned 1 [0112.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0112.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0112.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0112.421] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0112.421] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0112.421] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0112.422] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0112.422] ReadFile (in: hFile=0x314, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x31444, lpOverlapped=0x0) returned 1 [0112.432] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x31450, lpOverlapped=0x0) returned 1 [0112.442] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x102, lpOverlapped=0x0) returned 1 [0112.442] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0112.442] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0112.442] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x31444, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x31444, lpOverlapped=0x0) returned 1 [0112.444] FlushFileBuffers (hFile=0x314) returned 1 [0113.161] FlushFileBuffers (hFile=0x2ac) returned 1 [0113.163] CloseHandle (hObject=0x314) returned 1 [0113.172] CloseHandle (hObject=0x2ac) returned 1 [0113.182] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0113.187] SetEvent (hEvent=0x2b0) returned 1 [0113.188] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0113.194] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363faa0 | out: lpFileSize=0x363faa0*=88533) returned 1 [0113.194] CloseHandle (hObject=0x2ac) returned 1 [0113.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0113.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0113.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0113.195] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0113.195] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0113.195] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fa68 | out: lpNewFilePointer=0x0) returned 1 [0113.195] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0113.196] ReadFile (in: hFile=0x2ac, lpBuffer=0x3aca020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x363fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesRead=0x363fa7c*=0x159d5, lpOverlapped=0x0) returned 1 [0113.201] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0x159e0, lpOverlapped=0x0) returned 1 [0113.206] WriteFile (in: hFile=0x314, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fa54, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363fa54*=0xf2, lpOverlapped=0x0) returned 1 [0113.206] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0113.206] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363f7c8 | out: lpNewFilePointer=0x0) returned 1 [0113.206] WriteFile (in: hFile=0x2ac, lpBuffer=0x3aca020*, nNumberOfBytesToWrite=0x159d5, lpNumberOfBytesWritten=0x363f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3aca020*, lpNumberOfBytesWritten=0x363f7d4*=0x159d5, lpOverlapped=0x0) returned 1 [0113.207] FlushFileBuffers (hFile=0x2ac) Thread: id = 25 os_tid = 0x7f0 [0090.739] GetProcessHeap () returned 0xe70000 [0090.740] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0xf59a90 [0090.741] GetProcessHeap () returned 0xe70000 [0090.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x38a0048 [0090.742] GetProcessHeap () returned 0xe70000 [0090.742] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe9ae30 [0090.742] GetProcessHeap () returned 0xe70000 [0090.742] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x39a6020 [0090.750] GetProcessHeap () returned 0xe70000 [0090.750] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe99260 [0090.750] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0090.750] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0090.750] Wow64DisableWow64FsRedirection (in: OldValue=0x377f8b0 | out: OldValue=0x377f8b0*=0x0) returned 1 [0090.750] GetProcessHeap () returned 0xe70000 [0090.750] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe99260 | out: hHeap=0xe70000) returned 1 [0090.751] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0090.756] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=42674) returned 1 [0090.756] CloseHandle (hObject=0x2ac) returned 1 [0090.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0090.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0090.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0090.757] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0090.757] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0090.758] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0090.758] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0090.760] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xa6b2, lpOverlapped=0x0) returned 1 [0091.224] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xa6c0, lpOverlapped=0x0) returned 1 [0091.228] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x122, lpOverlapped=0x0) returned 1 [0091.229] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0091.229] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0091.229] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xa6b2, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xa6b2, lpOverlapped=0x0) returned 1 [0091.229] FlushFileBuffers (hFile=0x2ac) returned 1 [0092.483] FlushFileBuffers (hFile=0x2f8) returned 1 [0092.487] CloseHandle (hObject=0x2ac) returned 1 [0092.492] CloseHandle (hObject=0x2f8) returned 1 [0092.496] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0092.500] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0092.504] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=156) returned 1 [0092.504] CloseHandle (hObject=0x2f8) returned 1 [0092.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0092.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0092.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0092.505] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0092.505] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.505] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.505] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2ac [0092.505] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x9c, lpOverlapped=0x0) returned 1 [0092.508] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xa0, lpOverlapped=0x0) returned 1 [0092.510] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0092.511] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.511] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.511] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x9c, lpOverlapped=0x0) returned 1 [0092.511] FlushFileBuffers (hFile=0x2f8) returned 1 [0092.517] FlushFileBuffers (hFile=0x2ac) returned 1 [0092.522] CloseHandle (hObject=0x2f8) returned 1 [0092.524] CloseHandle (hObject=0x2ac) returned 1 [0092.528] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0092.531] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0092.531] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=577) returned 1 [0092.531] CloseHandle (hObject=0x2ac) returned 1 [0092.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0092.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0092.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0092.532] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0092.532] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.532] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.532] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0092.533] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x241, lpOverlapped=0x0) returned 1 [0092.727] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x250, lpOverlapped=0x0) returned 1 [0092.730] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x112, lpOverlapped=0x0) returned 1 [0092.730] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.730] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.731] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x241, lpOverlapped=0x0) returned 1 [0092.731] FlushFileBuffers (hFile=0x2ac) returned 1 [0092.735] FlushFileBuffers (hFile=0x2f8) returned 1 [0092.740] CloseHandle (hObject=0x2ac) returned 1 [0092.744] CloseHandle (hObject=0x2f8) returned 1 [0092.745] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0092.748] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0092.750] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=74) returned 1 [0092.750] CloseHandle (hObject=0x2f8) returned 1 [0092.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0092.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0092.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0092.751] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0092.751] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.752] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.752] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2ac [0092.753] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4a, lpOverlapped=0x0) returned 1 [0092.756] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x50, lpOverlapped=0x0) returned 1 [0092.758] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0092.759] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.759] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.759] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4a, lpOverlapped=0x0) returned 1 [0092.759] FlushFileBuffers (hFile=0x2f8) returned 1 [0092.765] FlushFileBuffers (hFile=0x2ac) returned 1 [0092.771] CloseHandle (hObject=0x2f8) returned 1 [0092.776] CloseHandle (hObject=0x2ac) returned 1 [0092.780] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0092.783] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0092.784] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=307) returned 1 [0092.784] CloseHandle (hObject=0x2ac) returned 1 [0092.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0092.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0092.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0092.785] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0092.785] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.785] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0092.785] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0092.785] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x133, lpOverlapped=0x0) returned 1 [0092.789] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x140, lpOverlapped=0x0) returned 1 [0092.792] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0092.794] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.794] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0092.794] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x133, lpOverlapped=0x0) returned 1 [0092.794] FlushFileBuffers (hFile=0x2ac) returned 1 [0093.461] FlushFileBuffers (hFile=0x2f8) returned 1 [0093.464] CloseHandle (hObject=0x2ac) returned 1 [0093.465] CloseHandle (hObject=0x2f8) returned 1 [0093.466] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0093.469] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0093.470] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=17240) returned 1 [0093.470] CloseHandle (hObject=0x2f8) returned 1 [0093.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0093.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0093.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0093.471] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0093.471] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0093.471] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0093.471] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0093.474] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4358, lpOverlapped=0x0) returned 1 [0093.536] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4360, lpOverlapped=0x0) returned 1 [0093.539] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0093.540] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0093.540] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0093.540] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4358, lpOverlapped=0x0) returned 1 [0093.540] FlushFileBuffers (hFile=0x2f8) returned 1 [0094.734] FlushFileBuffers (hFile=0x2ac) returned 1 [0094.739] CloseHandle (hObject=0x2f8) returned 1 [0094.744] CloseHandle (hObject=0x2ac) returned 1 [0094.748] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0094.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0094.754] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=14168) returned 1 [0094.754] CloseHandle (hObject=0x2ac) returned 1 [0094.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0094.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0094.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0094.755] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0094.755] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0094.755] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0094.756] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0094.756] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x3758, lpOverlapped=0x0) returned 1 [0094.760] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x3760, lpOverlapped=0x0) returned 1 [0094.763] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0094.763] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0094.763] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0094.763] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x3758, lpOverlapped=0x0) returned 1 [0094.764] FlushFileBuffers (hFile=0x2ac) returned 1 [0095.166] FlushFileBuffers (hFile=0x2f8) returned 1 [0095.169] CloseHandle (hObject=0x2ac) returned 1 [0095.170] CloseHandle (hObject=0x2f8) returned 1 [0095.172] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0095.174] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0095.175] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=80970) returned 1 [0095.178] CloseHandle (hObject=0x2f8) returned 1 [0095.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0095.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0095.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.179] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0095.179] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.179] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.179] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0095.180] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x13c4a, lpOverlapped=0x0) returned 1 [0095.185] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x13c50, lpOverlapped=0x0) returned 1 [0095.190] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0095.191] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.191] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.191] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x13c4a, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x13c4a, lpOverlapped=0x0) returned 1 [0095.192] FlushFileBuffers (hFile=0x2f8) returned 1 [0095.491] FlushFileBuffers (hFile=0x2ac) returned 1 [0095.494] CloseHandle (hObject=0x2f8) returned 1 [0095.498] CloseHandle (hObject=0x2ac) returned 1 [0095.503] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0095.507] SetEvent (hEvent=0x2b0) returned 1 [0095.507] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0095.507] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=3314) returned 1 [0095.508] CloseHandle (hObject=0x2ac) returned 1 [0095.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0095.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0095.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.508] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0095.508] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.508] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.509] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0095.513] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xcf2, lpOverlapped=0x0) returned 1 [0095.520] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xd00, lpOverlapped=0x0) returned 1 [0095.524] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0095.524] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.524] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.524] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xcf2, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xcf2, lpOverlapped=0x0) returned 1 [0095.525] FlushFileBuffers (hFile=0x2ac) returned 1 [0095.530] FlushFileBuffers (hFile=0x2f8) returned 1 [0095.534] CloseHandle (hObject=0x2ac) returned 1 [0095.535] CloseHandle (hObject=0x2f8) returned 1 [0095.539] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0095.541] SetEvent (hEvent=0x2b0) returned 1 [0095.541] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0095.542] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=77748) returned 1 [0095.542] CloseHandle (hObject=0x2f8) returned 1 [0095.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0095.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0095.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.542] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0095.543] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.543] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.543] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0095.543] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x12fb4, lpOverlapped=0x0) returned 1 [0095.550] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x12fc0, lpOverlapped=0x0) returned 1 [0095.554] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0095.555] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.555] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.556] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x12fb4, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x12fb4, lpOverlapped=0x0) returned 1 [0095.556] FlushFileBuffers (hFile=0x2f8) returned 1 [0095.893] FlushFileBuffers (hFile=0x2ac) returned 1 [0095.896] CloseHandle (hObject=0x2f8) returned 1 [0095.901] CloseHandle (hObject=0x2ac) returned 1 [0095.907] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0095.911] SetEvent (hEvent=0x2b0) returned 1 [0095.911] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0095.912] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=3419) returned 1 [0095.912] CloseHandle (hObject=0x2ac) returned 1 [0095.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0095.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0095.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.912] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0095.912] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.913] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.913] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0095.920] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xd5b, lpOverlapped=0x0) returned 1 [0095.924] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xd60, lpOverlapped=0x0) returned 1 [0095.928] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0095.928] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.928] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.928] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xd5b, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xd5b, lpOverlapped=0x0) returned 1 [0095.928] FlushFileBuffers (hFile=0x2ac) returned 1 [0095.934] FlushFileBuffers (hFile=0x2f8) returned 1 [0095.937] CloseHandle (hObject=0x2ac) returned 1 [0095.939] CloseHandle (hObject=0x2f8) returned 1 [0095.940] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0095.943] SetEvent (hEvent=0x2b0) returned 1 [0095.943] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0095.943] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=82346) returned 1 [0095.943] CloseHandle (hObject=0x2f8) returned 1 [0095.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0095.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0095.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.944] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0095.944] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.944] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.945] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0095.945] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x141aa, lpOverlapped=0x0) returned 1 [0095.951] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x141b0, lpOverlapped=0x0) returned 1 [0095.958] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0095.958] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.958] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.959] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x141aa, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x141aa, lpOverlapped=0x0) returned 1 [0095.959] FlushFileBuffers (hFile=0x2f8) returned 1 [0095.965] FlushFileBuffers (hFile=0x2ac) returned 1 [0095.968] CloseHandle (hObject=0x2f8) returned 1 [0095.973] CloseHandle (hObject=0x2ac) returned 1 [0095.978] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0095.982] SetEvent (hEvent=0x2b0) returned 1 [0095.983] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0095.983] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18776) returned 1 [0095.983] CloseHandle (hObject=0x2ac) returned 1 [0095.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0095.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0095.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0095.984] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0095.984] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.984] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0095.985] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0095.985] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4958, lpOverlapped=0x0) returned 1 [0095.991] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4960, lpOverlapped=0x0) returned 1 [0095.994] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0095.994] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.994] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0095.995] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4958, lpOverlapped=0x0) returned 1 [0095.995] FlushFileBuffers (hFile=0x2ac) returned 1 [0096.480] FlushFileBuffers (hFile=0x2f8) returned 1 [0096.486] CloseHandle (hObject=0x2ac) returned 1 [0096.488] CloseHandle (hObject=0x2f8) returned 1 [0096.492] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0096.494] SetEvent (hEvent=0x2b0) returned 1 [0096.495] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0096.495] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=19288) returned 1 [0096.495] CloseHandle (hObject=0x2f8) returned 1 [0096.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0096.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0096.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0096.496] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0096.496] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0096.496] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0096.496] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0096.497] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4b58, lpOverlapped=0x0) returned 1 [0096.503] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4b60, lpOverlapped=0x0) returned 1 [0096.506] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0096.507] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0096.507] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0096.507] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4b58, lpOverlapped=0x0) returned 1 [0096.508] FlushFileBuffers (hFile=0x2f8) returned 1 [0096.774] FlushFileBuffers (hFile=0x2ac) returned 1 [0096.777] CloseHandle (hObject=0x2f8) returned 1 [0096.779] CloseHandle (hObject=0x2ac) returned 1 [0096.781] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0096.784] SetEvent (hEvent=0x2b0) returned 1 [0096.785] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0096.785] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=17240) returned 1 [0096.785] CloseHandle (hObject=0x2ac) returned 1 [0096.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0096.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0096.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0096.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0096.786] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0096.786] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0096.787] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0096.787] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4358, lpOverlapped=0x0) returned 1 [0096.792] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4360, lpOverlapped=0x0) returned 1 [0096.795] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0096.796] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0096.796] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0096.796] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4358, lpOverlapped=0x0) returned 1 [0096.796] FlushFileBuffers (hFile=0x2ac) returned 1 [0097.537] FlushFileBuffers (hFile=0x2f8) returned 1 [0097.539] CloseHandle (hObject=0x2ac) returned 1 [0097.541] CloseHandle (hObject=0x2f8) returned 1 [0097.542] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0097.546] SetEvent (hEvent=0x2b0) returned 1 [0097.546] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0097.546] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18264) returned 1 [0097.546] CloseHandle (hObject=0x2f8) returned 1 [0097.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0097.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0097.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0097.547] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0097.547] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0097.548] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0097.548] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0097.549] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4758, lpOverlapped=0x0) returned 1 [0097.607] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4760, lpOverlapped=0x0) returned 1 [0097.611] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0097.612] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0097.612] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0097.612] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4758, lpOverlapped=0x0) returned 1 [0097.612] FlushFileBuffers (hFile=0x2f8) returned 1 [0098.802] FlushFileBuffers (hFile=0x2ac) returned 1 [0099.460] CloseHandle (hObject=0x2f8) returned 1 [0099.463] CloseHandle (hObject=0x2ac) returned 1 [0099.466] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0099.470] SetEvent (hEvent=0x2b0) returned 1 [0099.470] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0099.471] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18776) returned 1 [0099.471] CloseHandle (hObject=0x2ac) returned 1 [0099.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0099.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0099.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0099.472] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0099.472] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0099.472] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0099.472] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0099.473] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4958, lpOverlapped=0x0) returned 1 [0099.478] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4960, lpOverlapped=0x0) returned 1 [0099.482] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0099.482] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0099.483] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0099.483] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4958, lpOverlapped=0x0) returned 1 [0099.483] FlushFileBuffers (hFile=0x2ac) returned 1 [0099.811] FlushFileBuffers (hFile=0x2f8) returned 1 [0100.762] CloseHandle (hObject=0x2ac) returned 1 [0100.766] CloseHandle (hObject=0x2f8) returned 1 [0100.769] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0100.772] SetEvent (hEvent=0x2b0) returned 1 [0100.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0100.774] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=4254) returned 1 [0100.774] CloseHandle (hObject=0x2f8) returned 1 [0100.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0100.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0100.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0100.774] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0100.775] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0100.775] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0100.775] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0100.780] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x109e, lpOverlapped=0x0) returned 1 [0100.784] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x10a0, lpOverlapped=0x0) returned 1 [0100.787] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0100.788] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0100.788] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0100.788] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x109e, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x109e, lpOverlapped=0x0) returned 1 [0100.788] FlushFileBuffers (hFile=0x2f8) returned 1 [0100.797] FlushFileBuffers (hFile=0x2ac) returned 1 [0100.802] CloseHandle (hObject=0x2f8) returned 1 [0100.803] CloseHandle (hObject=0x2ac) returned 1 [0100.804] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0100.807] SetEvent (hEvent=0x2b0) returned 1 [0100.807] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0100.808] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=86442) returned 1 [0100.808] CloseHandle (hObject=0x2ac) returned 1 [0100.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0100.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0100.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0100.809] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0100.809] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0100.809] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0100.809] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0100.810] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x151aa, lpOverlapped=0x0) returned 1 [0100.815] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x151b0, lpOverlapped=0x0) returned 1 [0100.821] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0100.822] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0100.822] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0100.822] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x151aa, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x151aa, lpOverlapped=0x0) returned 1 [0100.824] FlushFileBuffers (hFile=0x2ac) returned 1 [0101.087] FlushFileBuffers (hFile=0x2f8) returned 1 [0101.091] CloseHandle (hObject=0x2ac) returned 1 [0101.097] CloseHandle (hObject=0x2f8) returned 1 [0101.104] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0101.109] SetEvent (hEvent=0x2b0) returned 1 [0101.109] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0101.111] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=3643) returned 1 [0101.111] CloseHandle (hObject=0x2f8) returned 1 [0101.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0101.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0101.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.112] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0101.112] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.112] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.113] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0101.117] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xe3b, lpOverlapped=0x0) returned 1 [0101.124] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xe40, lpOverlapped=0x0) returned 1 [0101.126] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0101.127] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.127] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.127] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xe3b, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xe3b, lpOverlapped=0x0) returned 1 [0101.127] FlushFileBuffers (hFile=0x2f8) returned 1 [0101.144] FlushFileBuffers (hFile=0x2ac) returned 1 [0101.161] CloseHandle (hObject=0x2f8) returned 1 [0101.162] CloseHandle (hObject=0x2ac) returned 1 [0101.163] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0101.166] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0101.168] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18264) returned 1 [0101.168] CloseHandle (hObject=0x2ac) returned 1 [0101.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0101.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0101.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.169] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0101.169] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.169] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.169] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0101.170] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4758, lpOverlapped=0x0) returned 1 [0101.199] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4760, lpOverlapped=0x0) returned 1 [0101.202] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0101.203] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.203] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.203] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4758, lpOverlapped=0x0) returned 1 [0101.203] FlushFileBuffers (hFile=0x2ac) returned 1 [0101.702] FlushFileBuffers (hFile=0x2f8) returned 1 [0101.706] CloseHandle (hObject=0x2ac) returned 1 [0101.707] CloseHandle (hObject=0x2f8) returned 1 [0101.709] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0101.711] SetEvent (hEvent=0x2b0) returned 1 [0101.712] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0101.712] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=68226) returned 1 [0101.712] CloseHandle (hObject=0x2f8) returned 1 [0101.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0101.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0101.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.713] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0101.713] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.713] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.713] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0101.714] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x10a82, lpOverlapped=0x0) returned 1 [0101.719] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x10a90, lpOverlapped=0x0) returned 1 [0101.724] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0101.724] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.724] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.725] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x10a82, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x10a82, lpOverlapped=0x0) returned 1 [0101.725] FlushFileBuffers (hFile=0x2f8) returned 1 [0101.745] FlushFileBuffers (hFile=0x2ac) returned 1 [0101.748] CloseHandle (hObject=0x2f8) returned 1 [0101.752] CloseHandle (hObject=0x2ac) returned 1 [0101.756] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0101.759] SetEvent (hEvent=0x2b0) returned 1 [0101.760] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0101.760] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=15704) returned 1 [0101.760] CloseHandle (hObject=0x2ac) returned 1 [0101.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0101.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0101.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0101.761] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0101.761] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.761] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0101.761] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0101.761] ReadFile (in: hFile=0x2ac, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x3d58, lpOverlapped=0x0) returned 1 [0101.766] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x3d60, lpOverlapped=0x0) returned 1 [0101.770] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0101.770] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.771] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0101.771] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3d58, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x3d58, lpOverlapped=0x0) returned 1 [0101.771] FlushFileBuffers (hFile=0x2ac) returned 1 [0104.196] FlushFileBuffers (hFile=0x2f8) returned 1 [0104.362] CloseHandle (hObject=0x2ac) returned 1 [0104.363] CloseHandle (hObject=0x2f8) returned 1 [0104.365] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0104.368] SetEvent (hEvent=0x2b0) returned 1 [0104.368] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0104.369] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=15192) returned 1 [0104.369] CloseHandle (hObject=0x2f8) returned 1 [0104.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0104.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0104.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0104.369] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0104.369] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0104.370] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0104.370] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0104.370] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x3b58, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x3b60, lpOverlapped=0x0) returned 1 [0104.432] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0104.449] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0104.449] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0104.449] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3b58, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x3b58, lpOverlapped=0x0) returned 1 [0104.450] FlushFileBuffers (hFile=0x2f8) returned 1 [0105.082] FlushFileBuffers (hFile=0x2ac) returned 1 [0105.101] CloseHandle (hObject=0x2f8) returned 1 [0105.103] CloseHandle (hObject=0x2ac) returned 1 [0105.104] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0105.107] SetEvent (hEvent=0x2b0) returned 1 [0105.107] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0105.114] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=79634) returned 1 [0105.114] CloseHandle (hObject=0x2f8) returned 1 [0105.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0105.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0105.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0105.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0105.114] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0105.115] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0105.115] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0105.115] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x13712, lpOverlapped=0x0) returned 1 [0105.127] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x13720, lpOverlapped=0x0) returned 1 [0105.133] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0105.133] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0105.133] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0105.133] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x13712, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x13712, lpOverlapped=0x0) returned 1 [0105.134] FlushFileBuffers (hFile=0x2f8) returned 1 [0105.190] FlushFileBuffers (hFile=0x318) returned 1 [0105.193] CloseHandle (hObject=0x2f8) returned 1 [0105.197] CloseHandle (hObject=0x318) returned 1 [0105.201] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0105.205] SetEvent (hEvent=0x2b0) returned 1 [0105.206] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0105.206] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=3046) returned 1 [0105.206] CloseHandle (hObject=0x318) returned 1 [0105.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0105.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0105.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0105.207] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0105.207] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0105.207] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0105.207] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0105.211] ReadFile (in: hFile=0x318, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xbe6, lpOverlapped=0x0) returned 1 [0105.215] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xbf0, lpOverlapped=0x0) returned 1 [0105.218] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0105.218] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0105.218] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0105.218] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xbe6, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xbe6, lpOverlapped=0x0) returned 1 [0105.219] FlushFileBuffers (hFile=0x318) returned 1 [0105.224] FlushFileBuffers (hFile=0x2f8) returned 1 [0105.227] CloseHandle (hObject=0x318) returned 1 [0105.228] CloseHandle (hObject=0x2f8) returned 1 [0105.229] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0105.232] SetEvent (hEvent=0x2b0) returned 1 [0105.232] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0105.232] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=79296) returned 1 [0105.232] CloseHandle (hObject=0x2f8) returned 1 [0105.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0105.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0105.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0105.233] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0105.233] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0105.233] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0105.233] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0105.234] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x135c0, lpOverlapped=0x0) returned 1 [0105.246] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x135d0, lpOverlapped=0x0) returned 1 [0105.252] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0105.252] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0105.252] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0105.252] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x135c0, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x135c0, lpOverlapped=0x0) returned 1 [0105.253] FlushFileBuffers (hFile=0x2f8) returned 1 [0106.307] FlushFileBuffers (hFile=0x318) returned 1 [0106.310] CloseHandle (hObject=0x2f8) returned 1 [0106.315] CloseHandle (hObject=0x318) returned 1 [0106.320] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0106.324] SetEvent (hEvent=0x2b0) returned 1 [0106.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0106.325] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=4040) returned 1 [0106.325] CloseHandle (hObject=0x318) returned 1 [0106.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0106.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0106.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0106.325] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0106.326] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0106.326] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0106.326] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0106.337] ReadFile (in: hFile=0x318, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xfc8, lpOverlapped=0x0) returned 1 [0106.340] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xfd0, lpOverlapped=0x0) returned 1 [0106.343] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0106.344] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0106.344] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0106.344] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xfc8, lpOverlapped=0x0) returned 1 [0106.351] FlushFileBuffers (hFile=0x318) returned 1 [0106.364] FlushFileBuffers (hFile=0x2f8) returned 1 [0106.368] CloseHandle (hObject=0x318) returned 1 [0106.369] CloseHandle (hObject=0x2f8) returned 1 [0106.370] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0106.372] SetEvent (hEvent=0x2b0) returned 1 [0106.373] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0106.373] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=82374) returned 1 [0106.373] CloseHandle (hObject=0x2f8) returned 1 [0106.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0106.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0106.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0106.374] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0106.374] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0106.374] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0106.374] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0106.375] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x141c6, lpOverlapped=0x0) returned 1 [0106.388] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x141d0, lpOverlapped=0x0) returned 1 [0106.395] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0106.395] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0106.395] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0106.395] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x141c6, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x141c6, lpOverlapped=0x0) returned 1 [0106.396] FlushFileBuffers (hFile=0x2f8) returned 1 [0106.655] FlushFileBuffers (hFile=0x318) returned 1 [0106.662] CloseHandle (hObject=0x2f8) returned 1 [0106.667] CloseHandle (hObject=0x318) returned 1 [0106.671] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0106.676] SetEvent (hEvent=0x2b0) returned 1 [0106.676] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0106.676] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18264) returned 1 [0106.676] CloseHandle (hObject=0x318) returned 1 [0106.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0106.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0106.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0106.677] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0106.677] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0106.677] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0106.677] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0106.678] ReadFile (in: hFile=0x318, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4758, lpOverlapped=0x0) returned 1 [0106.693] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4760, lpOverlapped=0x0) returned 1 [0106.701] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0106.701] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0106.702] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0106.702] WriteFile (in: hFile=0x318, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4758, lpOverlapped=0x0) returned 1 [0106.702] FlushFileBuffers (hFile=0x318) returned 1 [0107.566] FlushFileBuffers (hFile=0x2f8) returned 1 [0108.799] CloseHandle (hObject=0x318) returned 1 [0108.800] CloseHandle (hObject=0x2f8) returned 1 [0108.808] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0108.811] SetEvent (hEvent=0x2b0) returned 1 [0108.812] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0108.814] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=54456) returned 1 [0108.814] CloseHandle (hObject=0x338) returned 1 [0108.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0108.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0108.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0108.814] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0108.815] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0108.815] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0108.815] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0108.818] ReadFile (in: hFile=0x338, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xd4b8, lpOverlapped=0x0) returned 1 [0108.823] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xd4c0, lpOverlapped=0x0) returned 1 [0108.827] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0108.828] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0108.828] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0108.828] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xd4b8, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xd4b8, lpOverlapped=0x0) returned 1 [0108.829] FlushFileBuffers (hFile=0x338) returned 1 [0108.851] FlushFileBuffers (hFile=0x2f8) returned 1 [0108.853] CloseHandle (hObject=0x338) returned 1 [0108.861] CloseHandle (hObject=0x2f8) returned 1 [0108.868] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0108.871] SetEvent (hEvent=0x2b0) returned 1 [0108.872] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0108.872] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=81482) returned 1 [0108.872] CloseHandle (hObject=0x2f8) returned 1 [0108.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0108.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0108.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0108.881] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0108.881] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0108.881] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0108.881] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0108.882] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x13e4a, lpOverlapped=0x0) returned 1 [0108.888] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x13e50, lpOverlapped=0x0) returned 1 [0108.894] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0108.895] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0108.895] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0108.895] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x13e4a, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x13e4a, lpOverlapped=0x0) returned 1 [0108.896] FlushFileBuffers (hFile=0x2f8) returned 1 [0109.449] FlushFileBuffers (hFile=0x338) returned 1 [0109.455] CloseHandle (hObject=0x2f8) returned 1 [0109.459] CloseHandle (hObject=0x338) returned 1 [0109.462] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0109.466] SetEvent (hEvent=0x2b0) returned 1 [0109.467] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0109.467] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18264) returned 1 [0109.467] CloseHandle (hObject=0x338) returned 1 [0109.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0109.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0109.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.468] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0109.468] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0109.468] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0109.468] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0109.469] ReadFile (in: hFile=0x338, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4758, lpOverlapped=0x0) returned 1 [0109.473] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4760, lpOverlapped=0x0) returned 1 [0109.476] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0109.476] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0109.476] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0109.477] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4758, lpOverlapped=0x0) returned 1 [0109.477] FlushFileBuffers (hFile=0x338) returned 1 [0109.578] FlushFileBuffers (hFile=0x2f8) returned 1 [0109.581] CloseHandle (hObject=0x338) returned 1 [0109.582] CloseHandle (hObject=0x2f8) returned 1 [0109.583] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0109.586] SetEvent (hEvent=0x2b0) returned 1 [0109.586] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0109.587] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=3859) returned 1 [0109.587] CloseHandle (hObject=0x2f8) returned 1 [0109.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0109.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0109.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.587] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0109.588] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0109.588] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0109.588] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0109.591] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xf13, lpOverlapped=0x0) returned 1 [0109.594] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf20, lpOverlapped=0x0) returned 1 [0109.597] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0109.597] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0109.597] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0109.597] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf13, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xf13, lpOverlapped=0x0) returned 1 [0109.598] FlushFileBuffers (hFile=0x2f8) returned 1 [0109.602] FlushFileBuffers (hFile=0x338) returned 1 [0109.604] CloseHandle (hObject=0x2f8) returned 1 [0109.605] CloseHandle (hObject=0x338) returned 1 [0109.606] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0109.608] SetEvent (hEvent=0x2b0) returned 1 [0109.609] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0109.609] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=76818) returned 1 [0109.609] CloseHandle (hObject=0x338) returned 1 [0109.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0109.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0109.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0109.610] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0109.611] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0109.611] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0109.611] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0109.611] ReadFile (in: hFile=0x338, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x12c12, lpOverlapped=0x0) returned 1 [0109.616] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x12c20, lpOverlapped=0x0) returned 1 [0109.621] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0109.621] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0109.621] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0109.621] WriteFile (in: hFile=0x338, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x12c12, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x12c12, lpOverlapped=0x0) returned 1 [0109.622] FlushFileBuffers (hFile=0x338) returned 1 [0110.162] FlushFileBuffers (hFile=0x2f8) returned 1 [0110.166] CloseHandle (hObject=0x338) returned 1 [0110.174] CloseHandle (hObject=0x2f8) returned 1 [0110.183] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0110.241] SetEvent (hEvent=0x2b0) returned 1 [0110.241] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0110.241] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=5827) returned 1 [0110.242] CloseHandle (hObject=0x2f8) returned 1 [0110.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0110.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0110.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0110.242] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0110.242] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.242] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.243] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0110.251] ReadFile (in: hFile=0x2f8, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x16c3, lpOverlapped=0x0) returned 1 [0110.254] WriteFile (in: hFile=0x314, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x16d0, lpOverlapped=0x0) returned 1 [0110.257] WriteFile (in: hFile=0x314, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0110.257] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.258] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x16c3, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x16c3, lpOverlapped=0x0) returned 1 [0110.258] FlushFileBuffers (hFile=0x2f8) returned 1 [0110.270] FlushFileBuffers (hFile=0x314) returned 1 [0110.277] CloseHandle (hObject=0x2f8) returned 1 [0110.278] CloseHandle (hObject=0x314) returned 1 [0110.279] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0110.282] SetEvent (hEvent=0x2b0) returned 1 [0110.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0110.289] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=60684) returned 1 [0110.289] CloseHandle (hObject=0x300) returned 1 [0110.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0110.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0110.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0110.289] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0110.289] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.290] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.290] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0110.290] ReadFile (in: hFile=0x300, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xed0c, lpOverlapped=0x0) returned 1 [0110.294] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xed10, lpOverlapped=0x0) returned 1 [0110.300] WriteFile (in: hFile=0x2ac, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0110.300] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.301] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.301] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xed0c, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xed0c, lpOverlapped=0x0) returned 1 [0110.301] FlushFileBuffers (hFile=0x300) returned 1 [0110.686] FlushFileBuffers (hFile=0x2ac) returned 1 [0110.689] CloseHandle (hObject=0x300) returned 1 [0110.701] CloseHandle (hObject=0x2ac) returned 1 [0110.724] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0110.749] SetEvent (hEvent=0x2b0) returned 1 [0110.822] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0110.824] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=4015) returned 1 [0110.824] CloseHandle (hObject=0x300) returned 1 [0110.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0110.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0110.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0110.825] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0110.825] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.825] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.825] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0110.826] ReadFile (in: hFile=0x300, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0xfaf, lpOverlapped=0x0) returned 1 [0110.829] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xfb0, lpOverlapped=0x0) returned 1 [0110.831] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0110.832] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.832] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.832] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0xfaf, lpOverlapped=0x0) returned 1 [0110.832] FlushFileBuffers (hFile=0x300) returned 1 [0110.836] FlushFileBuffers (hFile=0x31c) returned 1 [0110.840] CloseHandle (hObject=0x300) returned 1 [0110.845] CloseHandle (hObject=0x31c) returned 1 [0110.849] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0110.852] SetEvent (hEvent=0x2b0) returned 1 [0110.853] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.853] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18776) returned 1 [0110.853] CloseHandle (hObject=0x31c) returned 1 [0110.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0110.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0110.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0110.854] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.854] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.855] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0110.855] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0110.855] ReadFile (in: hFile=0x31c, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4958, lpOverlapped=0x0) returned 1 [0110.860] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4960, lpOverlapped=0x0) returned 1 [0110.864] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0110.864] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.864] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0110.864] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4958, lpOverlapped=0x0) returned 1 [0110.865] FlushFileBuffers (hFile=0x31c) returned 1 [0111.372] FlushFileBuffers (hFile=0x300) returned 1 [0111.380] CloseHandle (hObject=0x31c) returned 1 [0111.381] CloseHandle (hObject=0x300) returned 1 [0111.384] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0111.386] SetEvent (hEvent=0x2b0) returned 1 [0111.387] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0111.387] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=6309) returned 1 [0111.388] CloseHandle (hObject=0x300) returned 1 [0111.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0111.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0111.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0111.388] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0111.388] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0111.388] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0111.389] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0111.393] ReadFile (in: hFile=0x300, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x18a5, lpOverlapped=0x0) returned 1 [0111.415] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x18b0, lpOverlapped=0x0) returned 1 [0111.418] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0111.418] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0111.418] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0111.418] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x18a5, lpOverlapped=0x0) returned 1 [0111.419] FlushFileBuffers (hFile=0x300) returned 1 [0111.442] FlushFileBuffers (hFile=0x31c) returned 1 [0111.449] CloseHandle (hObject=0x300) returned 1 [0111.449] CloseHandle (hObject=0x31c) returned 1 [0111.450] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0111.453] SetEvent (hEvent=0x2b0) returned 1 [0111.453] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0111.453] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=14168) returned 1 [0111.453] CloseHandle (hObject=0x31c) returned 1 [0111.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0111.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0111.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0111.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0111.454] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0111.454] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0111.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0111.455] ReadFile (in: hFile=0x31c, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x3758, lpOverlapped=0x0) returned 1 [0111.460] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x3760, lpOverlapped=0x0) returned 1 [0111.463] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0111.464] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0111.464] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0111.464] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x3758, lpOverlapped=0x0) returned 1 [0111.465] FlushFileBuffers (hFile=0x31c) returned 1 [0111.536] FlushFileBuffers (hFile=0x300) returned 1 [0111.540] CloseHandle (hObject=0x31c) returned 1 [0111.540] CloseHandle (hObject=0x300) returned 1 [0111.542] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0111.545] SetEvent (hEvent=0x2b0) returned 1 [0111.545] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0111.546] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=18776) returned 1 [0111.546] CloseHandle (hObject=0x300) returned 1 [0111.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0111.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0111.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0111.546] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0111.547] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0111.547] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0111.547] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0111.547] ReadFile (in: hFile=0x300, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x4958, lpOverlapped=0x0) returned 1 [0111.552] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x4960, lpOverlapped=0x0) returned 1 [0111.556] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0111.556] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0111.556] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0111.557] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x4958, lpOverlapped=0x0) returned 1 [0111.557] FlushFileBuffers (hFile=0x300) returned 1 [0112.670] FlushFileBuffers (hFile=0x31c) returned 1 [0112.673] CloseHandle (hObject=0x300) returned 1 [0112.675] CloseHandle (hObject=0x31c) returned 1 [0112.681] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0112.683] SetEvent (hEvent=0x2b0) returned 1 [0112.684] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.685] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=39042) returned 1 [0112.685] CloseHandle (hObject=0x31c) returned 1 [0112.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0112.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0112.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0112.686] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.686] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0112.686] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0112.686] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0112.690] ReadFile (in: hFile=0x31c, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x9882, lpOverlapped=0x0) returned 1 [0112.695] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x9890, lpOverlapped=0x0) returned 1 [0112.700] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0xf2, lpOverlapped=0x0) returned 1 [0112.700] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0112.700] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0112.700] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x9882, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x9882, lpOverlapped=0x0) returned 1 [0112.701] FlushFileBuffers (hFile=0x31c) returned 1 [0112.706] FlushFileBuffers (hFile=0x300) returned 1 [0112.708] CloseHandle (hObject=0x31c) returned 1 [0112.713] CloseHandle (hObject=0x300) returned 1 [0112.716] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0112.719] SetEvent (hEvent=0x2b0) returned 1 [0112.719] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0112.720] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x377f858 | out: lpFileSize=0x377f858*=16118) returned 1 [0112.720] CloseHandle (hObject=0x300) returned 1 [0112.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0112.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0112.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2396].[theonlyoption@qq.com].caleb")) returned 0xffffffff [0112.720] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0112.721] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0112.721] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f820 | out: lpNewFilePointer=0x0) returned 1 [0112.721] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2396].[theonlyoption@qq.com].Caleb" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2396].[theonlyoption@qq.com].caleb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0112.721] ReadFile (in: hFile=0x300, lpBuffer=0x39a6020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x377f834, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesRead=0x377f834*=0x3ef6, lpOverlapped=0x0) returned 1 [0112.873] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x3f00, lpOverlapped=0x0) returned 1 [0112.876] WriteFile (in: hFile=0x31c, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377f80c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f80c*=0x102, lpOverlapped=0x0) returned 1 [0112.877] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0112.877] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377f580 | out: lpNewFilePointer=0x0) returned 1 [0112.877] WriteFile (in: hFile=0x300, lpBuffer=0x39a6020*, nNumberOfBytesToWrite=0x3ef6, lpNumberOfBytesWritten=0x377f58c, lpOverlapped=0x0 | out: lpBuffer=0x39a6020*, lpNumberOfBytesWritten=0x377f58c*=0x3ef6, lpOverlapped=0x0) returned 1 [0112.877] FlushFileBuffers (hFile=0x300) Thread: id = 29 os_tid = 0x838 Thread: id = 30 os_tid = 0xc6c Process: id = "2" image_name = "cusersadministratorappdatalocal5.10.2019taskmgr.exe" filename = "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe" page_root = "0x6b3e000" os_pid = "0x4ac" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe94" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xdc0 [0078.199] GetProcessHeap () returned 0x13b0000 [0078.199] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x30) returned 0x13c6168 [0078.199] GetProcessHeap () returned 0x13b0000 [0078.199] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x3330) returned 0x13c6940 [0078.207] GetProcessHeap () returned 0x13b0000 [0078.207] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x204) returned 0x13c9c78 [0078.208] GetProcessHeap () returned 0x13b0000 [0078.208] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10) returned 0x13badf8 [0078.208] GetTickCount () returned 0x1153c4a [0078.209] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10ffb48 | out: lpWSAData=0x10ffb48) returned 0 [0078.223] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x10ffb28, cchData=32 | out: lpLCData="\x03") returned 16 [0078.225] GetProcessHeap () returned 0x13b0000 [0078.225] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1c) returned 0x13b4d28 [0078.225] GetProcessHeap () returned 0x13b0000 [0078.225] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1c) returned 0x13b5108 [0078.225] GetVersion () returned 0x23f00206 [0078.225] GetCurrentProcess () returned 0xffffffff [0078.225] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x10ffa9c | out: TokenHandle=0x10ffa9c*=0x1ec) returned 1 [0078.226] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x10ffa94, TokenInformationLength=0x4, ReturnLength=0x10ffa98 | out: TokenInformation=0x10ffa94, ReturnLength=0x10ffa98) returned 1 [0078.226] CloseHandle (hObject=0x1ec) returned 1 [0078.226] GetProcessHeap () returned 0x13b0000 [0078.226] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13b4658 [0078.226] GetProcessHeap () returned 0x13b0000 [0078.226] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13b2c00 [0078.226] GetProcessHeap () returned 0x13b0000 [0078.226] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13b0568 [0078.226] GetProcessHeap () returned 0x13b0000 [0078.226] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.226] GetProcessHeap () returned 0x13b0000 [0078.226] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.226] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13b2c00, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.226] GetProcessHeap () returned 0x13b0000 [0078.227] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b0568 | out: hHeap=0x13b0000) returned 1 [0078.227] GetProcessHeap () returned 0x13b0000 [0078.227] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b4658 | out: hHeap=0x13b0000) returned 1 [0078.227] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.228] GetProcessHeap () returned 0x13b0000 [0078.228] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b2c00 | out: hHeap=0x13b0000) returned 1 [0078.228] GetProcessHeap () returned 0x13b0000 [0078.228] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be080 [0078.228] GetProcessHeap () returned 0x13b0000 [0078.228] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdd68 [0078.228] GetProcessHeap () returned 0x13b0000 [0078.228] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdd68, Size=0x72) returned 0x13b4110 [0078.228] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0078.228] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x1ec [0078.228] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be080 | out: hHeap=0x13b0000) returned 1 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b4110 | out: hHeap=0x13b0000) returned 1 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13b2c00 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13b4658 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13b0568 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.229] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13b4658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.229] GetProcessHeap () returned 0x13b0000 [0078.229] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b0568 | out: hHeap=0x13b0000) returned 1 [0078.230] GetProcessHeap () returned 0x13b0000 [0078.230] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b2c00 | out: hHeap=0x13b0000) returned 1 [0078.230] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffa24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffa24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.230] GetProcessHeap () returned 0x13b0000 [0078.230] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b4658 | out: hHeap=0x13b0000) returned 1 [0078.230] GetProcessHeap () returned 0x13b0000 [0078.230] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13bdd68 [0078.230] GetProcessHeap () returned 0x13b0000 [0078.230] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bddb0 [0078.230] GetProcessHeap () returned 0x13b0000 [0078.230] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bddb0, Size=0x72) returned 0x13cf210 [0078.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x1f0 [0078.231] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0078.231] CloseHandle (hObject=0x1f0) returned 1 [0078.231] GetProcessHeap () returned 0x13b0000 [0078.231] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdd68 | out: hHeap=0x13b0000) returned 1 [0078.231] GetProcessHeap () returned 0x13b0000 [0078.232] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf210 | out: hHeap=0x13b0000) returned 1 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x60) returned 0x13b4110 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13b4658 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13b2c00 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13b0568 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.232] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x13b2c00, nSize=0xf | out: lpDst="") returned 0x1e [0078.232] GetProcessHeap () returned 0x13b0000 [0078.232] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b0568 | out: hHeap=0x13b0000) returned 1 [0078.232] GetProcessHeap () returned 0x13b0000 [0078.233] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b2c00, Size=0x3a) returned 0x13ba438 [0078.233] GetProcessHeap () returned 0x13b0000 [0078.233] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x3a) returned 0x13bdff0 [0078.233] GetProcessHeap () returned 0x13b0000 [0078.233] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.233] GetProcessHeap () returned 0x13b0000 [0078.233] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.234] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x13ba438, nSize=0x1d | out: lpDst="") returned 0x1e [0078.234] GetProcessHeap () returned 0x13b0000 [0078.234] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdff0 | out: hHeap=0x13b0000) returned 1 [0078.234] GetProcessHeap () returned 0x13b0000 [0078.234] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13ba438, Size=0x72) returned 0x13b3a50 [0078.234] GetProcessHeap () returned 0x13b0000 [0078.234] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x72) returned 0x13cef10 [0078.234] GetProcessHeap () returned 0x13b0000 [0078.234] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.234] GetProcessHeap () returned 0x13b0000 [0078.234] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.234] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x13b3a50, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0078.234] GetProcessHeap () returned 0x13b0000 [0078.234] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cef10 | out: hHeap=0x13b0000) returned 1 [0078.235] GetProcessHeap () returned 0x13b0000 [0078.235] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b4658 | out: hHeap=0x13b0000) returned 1 [0078.235] GetProcessHeap () returned 0x13b0000 [0078.235] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13bdb28 [0078.235] GetProcessHeap () returned 0x13b0000 [0078.235] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3e) returned 0x13bde88 [0078.235] GetProcessHeap () returned 0x13b0000 [0078.235] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x3e) returned 0x13be110 [0078.235] GetProcessHeap () returned 0x13b0000 [0078.235] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.235] GetProcessHeap () returned 0x13b0000 [0078.235] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x10) returned 0x13baeb8 [0078.235] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff97c | out: phkResult=0x10ff97c*=0x1f4) returned 0x0 [0078.236] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ff978, lpData=0x13be110, lpcbData=0x10ff980*=0x3e | out: lpType=0x10ff978*=0x2, lpData=0x13be110*=0x43, lpcbData=0x10ff980*=0x98) returned 0xea [0078.236] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.236] GetProcessHeap () returned 0x13b0000 [0078.236] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13baeb8 | out: hHeap=0x13b0000) returned 1 [0078.236] GetProcessHeap () returned 0x13b0000 [0078.236] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.236] GetProcessHeap () returned 0x13b0000 [0078.236] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be110 | out: hHeap=0x13b0000) returned 1 [0078.236] GetProcessHeap () returned 0x13b0000 [0078.236] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bde88, Size=0x7a) returned 0x13b2ea0 [0078.236] GetProcessHeap () returned 0x13b0000 [0078.236] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x7a) returned 0x13b4a78 [0078.236] GetProcessHeap () returned 0x13b0000 [0078.237] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.237] GetProcessHeap () returned 0x13b0000 [0078.237] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x10) returned 0x13baeb8 [0078.237] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff97c | out: phkResult=0x10ff97c*=0x1f4) returned 0x0 [0078.237] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ff978, lpData=0x13b4a78, lpcbData=0x10ff980*=0x7a | out: lpType=0x10ff978*=0x2, lpData=0x13b4a78*=0x0, lpcbData=0x10ff980*=0x98) returned 0xea [0078.237] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.237] GetProcessHeap () returned 0x13b0000 [0078.237] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13baeb8 | out: hHeap=0x13b0000) returned 1 [0078.237] GetProcessHeap () returned 0x13b0000 [0078.237] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.237] GetProcessHeap () returned 0x13b0000 [0078.237] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b4a78 | out: hHeap=0x13b0000) returned 1 [0078.237] GetProcessHeap () returned 0x13b0000 [0078.237] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b2ea0, Size=0xf2) returned 0x13b9058 [0078.238] GetProcessHeap () returned 0x13b0000 [0078.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xf2) returned 0x13b8e40 [0078.238] GetProcessHeap () returned 0x13b0000 [0078.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.238] GetProcessHeap () returned 0x13b0000 [0078.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x10) returned 0x13baeb8 [0078.238] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff97c | out: phkResult=0x10ff97c*=0x1f4) returned 0x0 [0078.238] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ff978, lpData=0x13b8e40, lpcbData=0x10ff980*=0xf2 | out: lpType=0x10ff978*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x10ff980*=0x98) returned 0x0 [0078.238] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.238] GetProcessHeap () returned 0x13b0000 [0078.238] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13baeb8 | out: hHeap=0x13b0000) returned 1 [0078.238] GetProcessHeap () returned 0x13b0000 [0078.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf4b8 [0078.238] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff97c | out: phkResult=0x10ff97c*=0x1f4) returned 0x0 [0078.239] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ff978, lpData=0x13b8ed8, lpcbData=0x10ff980*=0x5a | out: lpType=0x10ff978*=0x0, lpData=0x13b8ed8*=0x1a, lpcbData=0x10ff980*=0x5a) returned 0x2 [0078.239] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.239] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff990 | out: phkResult=0x10ff990*=0x1f4) returned 0x0 [0078.239] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ff98c, lpData=0x13b8ed8, lpcbData=0x10ff994*=0x5a | out: lpType=0x10ff98c*=0x2, lpData=0x13b8ed8*=0x1a, lpcbData=0x10ff994*=0x78) returned 0xea [0078.239] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.239] GetProcessHeap () returned 0x13b0000 [0078.239] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf4b8 | out: hHeap=0x13b0000) returned 1 [0078.239] GetProcessHeap () returned 0x13b0000 [0078.239] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.240] GetProcessHeap () returned 0x13b0000 [0078.240] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b8e40 | out: hHeap=0x13b0000) returned 1 [0078.240] GetProcessHeap () returned 0x13b0000 [0078.240] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b9058, Size=0x1e2) returned 0x13cf7f8 [0078.240] GetProcessHeap () returned 0x13b0000 [0078.240] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e2) returned 0x13cf9e8 [0078.240] GetProcessHeap () returned 0x13b0000 [0078.240] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0078.240] GetProcessHeap () returned 0x13b0000 [0078.240] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x10) returned 0x13bae58 [0078.240] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff97c | out: phkResult=0x10ff97c*=0x1f4) returned 0x0 [0078.240] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ff978, lpData=0x13cf9e8, lpcbData=0x10ff980*=0x1e2 | out: lpType=0x10ff978*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x10ff980*=0x98) returned 0x0 [0078.240] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.240] GetProcessHeap () returned 0x13b0000 [0078.240] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bae58 | out: hHeap=0x13b0000) returned 1 [0078.241] GetProcessHeap () returned 0x13b0000 [0078.241] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf4e0 [0078.241] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff97c | out: phkResult=0x10ff97c*=0x1f4) returned 0x0 [0078.241] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ff978, lpData=0x13cfa80, lpcbData=0x10ff980*=0x14a | out: lpType=0x10ff978*=0x0, lpData=0x13cfa80*=0x0, lpcbData=0x10ff980*=0x14a) returned 0x2 [0078.241] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.241] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ff990 | out: phkResult=0x10ff990*=0x1f4) returned 0x0 [0078.241] RegQueryValueExW (in: hKey=0x1f4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ff98c, lpData=0x13cfa80, lpcbData=0x10ff994*=0x14a | out: lpType=0x10ff98c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x10ff994*=0x78) returned 0x0 [0078.241] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.241] GetProcessHeap () returned 0x13b0000 [0078.241] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf4e0 | out: hHeap=0x13b0000) returned 1 [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0078.242] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x13cf7f8, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf9e8 | out: hHeap=0x13b0000) returned 1 [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdb28 | out: hHeap=0x13b0000) returned 1 [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13cf9e8 [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13cfc00 [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13cfe18 [0078.242] GetProcessHeap () returned 0x13b0000 [0078.242] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13d0030 [0078.242] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13cf9e8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0078.242] GetProcessHeap () returned 0x13b0000 [0078.243] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13d0248 [0078.243] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13d0248, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0078.243] GetProcessHeap () returned 0x13b0000 [0078.243] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d0248 | out: hHeap=0x13b0000) returned 1 [0078.243] GetProcessHeap () returned 0x13b0000 [0078.243] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13d0248 [0078.243] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13d0248, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0078.243] GetProcessHeap () returned 0x13b0000 [0078.243] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d0248 | out: hHeap=0x13b0000) returned 1 [0078.243] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), bFailIfExists=0) returned 1 [0078.642] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x10ffa78 | out: phkResult=0x10ffa78*=0x1f4) returned 0x0 [0078.643] RegSetValueExW (hKey=0x1f4, lpValueName="CUsersAdministratorAppDataLocal5.10.2019Taskmgr", Reserved=0x0, dwType=0x1, lpData=0x13cfc00, cbData=0xa2) returned 0x5 [0078.643] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.643] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x10ffa74 | out: phkResult=0x10ffa74*=0x1f4) returned 0x0 [0078.643] RegSetValueExW (in: hKey=0x1f4, lpValueName="CUsersAdministratorAppDataLocal5.10.2019Taskmgr", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe", cbData=0xa2 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe") returned 0x0 [0078.711] RegCloseKey (hKey=0x1f4) returned 0x0 [0078.711] GetProcessHeap () returned 0x13b0000 [0078.711] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x118) returned 0x13ba898 [0078.712] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), bFailIfExists=1) returned 1 [0080.511] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdatalocal5.10.2019taskmgr.exe"), bFailIfExists=1) returned 0 [0080.524] GetProcessHeap () returned 0x13b0000 [0080.524] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ba898 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf9e8 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cfc00 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cfe18 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d0030 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b4110 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b3a50 | out: hHeap=0x13b0000) returned 1 [0080.525] GetProcessHeap () returned 0x13b0000 [0080.525] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf7f8 | out: hHeap=0x13b0000) returned 1 [0080.526] GetProcessHeap () returned 0x13b0000 [0080.526] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf580 [0080.526] GetProcessHeap () returned 0x13b0000 [0080.526] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf670 [0080.526] GetProcessHeap () returned 0x13b0000 [0080.526] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf5f8 [0080.526] GetProcessHeap () returned 0x13b0000 [0080.526] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.526] GetProcessHeap () returned 0x13b0000 [0080.526] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.526] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf670, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.527] GetProcessHeap () returned 0x13b0000 [0080.527] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf5f8 | out: hHeap=0x13b0000) returned 1 [0080.527] GetProcessHeap () returned 0x13b0000 [0080.527] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf580 | out: hHeap=0x13b0000) returned 1 [0080.527] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffa94, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffa94*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.528] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf670 | out: hHeap=0x13b0000) returned 1 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.528] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x28) returned 0x13c04f0 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.528] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10) returned 0x13baeb8 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.528] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x60) returned 0x13b3a50 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.528] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x5c) returned 0x13b4110 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.528] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b4110, Size=0xb6) returned 0x13bb630 [0080.528] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10) returned 0x13b8448 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x180) returned 0x13ba670 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x250) returned 0x13cf7f8 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x84) returned 0x13b8890 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x84) returned 0x13baed0 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13bb7a8 [0080.529] GetProcessHeap () returned 0x13b0000 [0080.529] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bb7a8 | out: hHeap=0x13b0000) returned 1 [0080.530] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x13b8890, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13baed0 | out: hHeap=0x13b0000) returned 1 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xc0) returned 0x13bb7a8 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0xb8) returned 0x13ba548 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xb8) returned 0x13bb500 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.530] GetProcessHeap () returned 0x13b0000 [0080.530] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.530] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x13ba548, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bb500 | out: hHeap=0x13b0000) returned 1 [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bb7a8 | out: hHeap=0x13b0000) returned 1 [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13cfa50 [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13cfc68 [0080.531] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13cfc68, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cfc68 | out: hHeap=0x13b0000) returned 1 [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x174) returned 0x13cfc68 [0080.531] GetProcessHeap () returned 0x13b0000 [0080.531] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13cfc68, Size=0x3be) returned 0x13cfc68 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x86) returned 0x13b5000 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b5000, Size=0xee) returned 0x13bb3b8 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xba) returned 0x13bb7a8 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cfa50 | out: hHeap=0x13b0000) returned 1 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ba670 | out: hHeap=0x13b0000) returned 1 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf7f8 | out: hHeap=0x13b0000) returned 1 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b8890 | out: hHeap=0x13b0000) returned 1 [0080.532] GetProcessHeap () returned 0x13b0000 [0080.532] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ba548 | out: hHeap=0x13b0000) returned 1 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13baeb8 | out: hHeap=0x13b0000) returned 1 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b3a50 | out: hHeap=0x13b0000) returned 1 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf760 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf670 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf580 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.533] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.533] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf670, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.533] GetProcessHeap () returned 0x13b0000 [0080.534] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf580 | out: hHeap=0x13b0000) returned 1 [0080.534] GetProcessHeap () returned 0x13b0000 [0080.534] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf760 | out: hHeap=0x13b0000) returned 1 [0080.534] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffa94, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffa94*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.534] GetProcessHeap () returned 0x13b0000 [0080.534] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf670 | out: hHeap=0x13b0000) returned 1 [0080.534] GetProcessHeap () returned 0x13b0000 [0080.534] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x28) returned 0x13c04c0 [0080.534] GetProcessHeap () returned 0x13b0000 [0080.535] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10) returned 0x13b8400 [0080.535] GetProcessHeap () returned 0x13b0000 [0080.535] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x60) returned 0x13b3a50 [0080.535] GetProcessHeap () returned 0x13b0000 [0080.535] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x5c) returned 0x13b4110 [0080.535] GetProcessHeap () returned 0x13b0000 [0080.535] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b4110, Size=0xb6) returned 0x13ba548 [0080.535] GetProcessHeap () returned 0x13b0000 [0080.535] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10) returned 0x13b83b8 [0080.535] GetProcessHeap () returned 0x13b0000 [0080.538] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x180) returned 0x13ba670 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x250) returned 0x13cf7f8 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x84) returned 0x13b8890 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x84) returned 0x13baed0 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13bb500 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bb500 | out: hHeap=0x13b0000) returned 1 [0080.538] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x13b8890, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0080.538] GetProcessHeap () returned 0x13b0000 [0080.538] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13baed0 | out: hHeap=0x13b0000) returned 1 [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xc0) returned 0x13bb500 [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0xb8) returned 0x13ba300 [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xb8) returned 0x13ba1c0 [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.539] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x13ba300, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0080.539] GetProcessHeap () returned 0x13b0000 [0080.539] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ba1c0 | out: hHeap=0x13b0000) returned 1 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bb500 | out: hHeap=0x13b0000) returned 1 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13cfa50 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20a) returned 0x13d0030 [0080.540] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13d0030, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\CUsersAdministratorAppDataLocal5.10.2019Taskmgr.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdatalocal5.10.2019taskmgr.exe")) returned 0x4b [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d0030 | out: hHeap=0x13b0000) returned 1 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x174) returned 0x13d0030 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x24e) returned 0x13d01b0 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.540] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x86) returned 0x13b5000 [0080.540] GetProcessHeap () returned 0x13b0000 [0080.541] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13b5000, Size=0xee) returned 0x13b3e58 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0xba) returned 0x13bb500 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cfa50 | out: hHeap=0x13b0000) returned 1 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ba670 | out: hHeap=0x13b0000) returned 1 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf7f8 | out: hHeap=0x13b0000) returned 1 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b8890 | out: hHeap=0x13b0000) returned 1 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ba300 | out: hHeap=0x13b0000) returned 1 [0080.541] GetProcessHeap () returned 0x13b0000 [0080.541] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b8400 | out: hHeap=0x13b0000) returned 1 [0080.542] GetProcessHeap () returned 0x13b0000 [0080.542] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b3a50 | out: hHeap=0x13b0000) returned 1 [0080.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd2013, lpParameter=0x10ffac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0080.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd1fab, lpParameter=0x10ffad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0080.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd1e4e, lpParameter=0x10ffadc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0080.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd1859, lpParameter=0x10ffad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0080.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd197c, lpParameter=0x10ffad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0080.550] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0xffffffff) returned 0x0 [0082.816] WaitForMultipleObjects (nCount=0x4, lpHandles=0x10ffae8*=0x1f4, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0x37c Thread: id = 5 os_tid = 0x7b4 [0080.941] GetVersion () returned 0x23f00206 [0080.941] GetCurrentProcess () returned 0xffffffff [0080.941] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2d4fa68 | out: TokenHandle=0x2d4fa68*=0x228) returned 1 [0080.942] GetTokenInformation (in: TokenHandle=0x228, TokenInformationClass=0x14, TokenInformation=0x2d4fa60, TokenInformationLength=0x4, ReturnLength=0x2d4fa64 | out: TokenInformation=0x2d4fa60, ReturnLength=0x2d4fa64) returned 1 [0080.942] CloseHandle (hObject=0x228) returned 1 [0080.942] GetProcessHeap () returned 0x13b0000 [0080.942] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf7b0 [0080.942] GetProcessHeap () returned 0x13b0000 [0080.942] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf468 [0080.943] GetProcessHeap () returned 0x13b0000 [0080.943] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf440 [0080.943] GetProcessHeap () returned 0x13b0000 [0080.943] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13b5000 [0080.943] GetProcessHeap () returned 0x13b0000 [0080.943] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13b5000 | out: hHeap=0x13b0000) returned 1 [0080.943] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf468, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.943] GetProcessHeap () returned 0x13b0000 [0080.943] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf440 | out: hHeap=0x13b0000) returned 1 [0080.943] GetProcessHeap () returned 0x13b0000 [0080.943] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf7b0 | out: hHeap=0x13b0000) returned 1 [0080.943] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.944] GetProcessHeap () returned 0x13b0000 [0080.944] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf468 | out: hHeap=0x13b0000) returned 1 [0080.944] GetProcessHeap () returned 0x13b0000 [0080.944] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13bdd68 [0080.944] GetProcessHeap () returned 0x13b0000 [0080.944] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bde88 [0080.944] GetProcessHeap () returned 0x13b0000 [0080.944] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bde88, Size=0x72) returned 0x13cef10 [0080.945] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x228 [0080.945] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0080.945] CloseHandle (hObject=0x228) returned 1 [0080.945] GetProcessHeap () returned 0x13b0000 [0080.945] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdd68 | out: hHeap=0x13b0000) returned 1 [0080.945] GetProcessHeap () returned 0x13b0000 [0080.945] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cef10 | out: hHeap=0x13b0000) returned 1 [0080.946] Sleep (dwMilliseconds=0x3e8) [0082.269] GetProcessHeap () returned 0x13b0000 [0082.269] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf760 [0082.269] GetProcessHeap () returned 0x13b0000 [0082.269] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf698 [0082.269] GetProcessHeap () returned 0x13b0000 [0082.269] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf580 [0082.270] GetProcessHeap () returned 0x13b0000 [0082.270] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6448 [0082.270] GetProcessHeap () returned 0x13b0000 [0082.270] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6448 | out: hHeap=0x13b0000) returned 1 [0082.270] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf698, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.270] GetProcessHeap () returned 0x13b0000 [0082.270] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf580 | out: hHeap=0x13b0000) returned 1 [0082.270] GetProcessHeap () returned 0x13b0000 [0082.270] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf760 | out: hHeap=0x13b0000) returned 1 [0082.270] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.271] GetProcessHeap () returned 0x13b0000 [0082.271] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf698 | out: hHeap=0x13b0000) returned 1 [0082.271] GetProcessHeap () returned 0x13b0000 [0082.271] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13bdf60 [0082.271] GetProcessHeap () returned 0x13b0000 [0082.271] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13be110 [0082.271] GetProcessHeap () returned 0x13b0000 [0082.271] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13be110, Size=0x72) returned 0x13ce990 [0082.271] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x240 [0082.271] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x102 [0082.272] CloseHandle (hObject=0x240) returned 1 [0082.272] GetProcessHeap () returned 0x13b0000 [0082.272] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdf60 | out: hHeap=0x13b0000) returned 1 [0082.272] GetProcessHeap () returned 0x13b0000 [0082.272] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ce990 | out: hHeap=0x13b0000) returned 1 [0082.273] Sleep (dwMilliseconds=0x3e8) [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf6e8 [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf5a8 [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf670 [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6d30 [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6d30 | out: hHeap=0x13b0000) returned 1 [0083.722] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf5a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf670 | out: hHeap=0x13b0000) returned 1 [0083.722] GetProcessHeap () returned 0x13b0000 [0083.722] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf6e8 | out: hHeap=0x13b0000) returned 1 [0083.723] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0083.725] GetProcessHeap () returned 0x13b0000 [0083.725] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf5a8 | out: hHeap=0x13b0000) returned 1 [0083.725] GetProcessHeap () returned 0x13b0000 [0083.725] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be080 [0083.725] GetProcessHeap () returned 0x13b0000 [0083.725] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13be0c8 [0083.725] GetProcessHeap () returned 0x13b0000 [0083.725] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13be0c8, Size=0x72) returned 0x13ce410 [0083.725] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x28c [0083.726] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x102 [0083.726] CloseHandle (hObject=0x28c) returned 1 [0083.726] GetProcessHeap () returned 0x13b0000 [0083.726] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be080 | out: hHeap=0x13b0000) returned 1 [0083.726] GetProcessHeap () returned 0x13b0000 [0083.726] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ce410 | out: hHeap=0x13b0000) returned 1 [0083.726] Sleep (dwMilliseconds=0x3e8) [0086.237] GetProcessHeap () returned 0x13b0000 [0086.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf468 [0086.238] GetProcessHeap () returned 0x13b0000 [0086.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9768 [0086.238] GetProcessHeap () returned 0x13b0000 [0086.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e97b8 [0086.238] GetProcessHeap () returned 0x13b0000 [0086.238] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6a38 [0086.238] GetProcessHeap () returned 0x13b0000 [0086.238] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6a38 | out: hHeap=0x13b0000) returned 1 [0086.238] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9768, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0086.238] GetProcessHeap () returned 0x13b0000 [0086.238] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e97b8 | out: hHeap=0x13b0000) returned 1 [0086.238] GetProcessHeap () returned 0x13b0000 [0086.238] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf468 | out: hHeap=0x13b0000) returned 1 [0086.238] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0086.239] GetProcessHeap () returned 0x13b0000 [0086.239] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9768 | out: hHeap=0x13b0000) returned 1 [0086.239] GetProcessHeap () returned 0x13b0000 [0086.239] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be080 [0086.239] GetProcessHeap () returned 0x13b0000 [0086.239] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13be110 [0086.239] GetProcessHeap () returned 0x13b0000 [0086.239] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13be110, Size=0x72) returned 0x13ce890 [0086.240] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2b0 [0086.240] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0086.240] CloseHandle (hObject=0x2b0) returned 1 [0086.240] GetProcessHeap () returned 0x13b0000 [0086.240] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be080 | out: hHeap=0x13b0000) returned 1 [0086.240] GetProcessHeap () returned 0x13b0000 [0086.240] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ce890 | out: hHeap=0x13b0000) returned 1 [0086.240] Sleep (dwMilliseconds=0x3e8) [0088.223] GetProcessHeap () returned 0x13b0000 [0088.223] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9c68 [0088.223] GetProcessHeap () returned 0x13b0000 [0088.223] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9ba0 [0088.223] GetProcessHeap () returned 0x13b0000 [0088.224] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9b00 [0088.224] GetProcessHeap () returned 0x13b0000 [0088.224] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6ad0 [0088.224] GetProcessHeap () returned 0x13b0000 [0088.224] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6ad0 | out: hHeap=0x13b0000) returned 1 [0088.224] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9ba0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.224] GetProcessHeap () returned 0x13b0000 [0088.224] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9b00 | out: hHeap=0x13b0000) returned 1 [0088.224] GetProcessHeap () returned 0x13b0000 [0088.224] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c68 | out: hHeap=0x13b0000) returned 1 [0088.224] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.226] GetProcessHeap () returned 0x13b0000 [0088.226] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0088.226] GetProcessHeap () returned 0x13b0000 [0088.226] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0088.226] GetProcessHeap () returned 0x13b0000 [0088.226] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0088.226] GetProcessHeap () returned 0x13b0000 [0088.227] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cf090 [0088.227] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0088.227] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0088.227] CloseHandle (hObject=0x2dc) returned 1 [0088.227] GetProcessHeap () returned 0x13b0000 [0088.227] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0088.227] GetProcessHeap () returned 0x13b0000 [0088.227] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf090 | out: hHeap=0x13b0000) returned 1 [0088.227] Sleep (dwMilliseconds=0x3e8) [0090.478] GetProcessHeap () returned 0x13b0000 [0090.478] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9ba0 [0090.479] GetProcessHeap () returned 0x13b0000 [0090.479] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9bf0 [0090.479] GetProcessHeap () returned 0x13b0000 [0090.479] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9bc8 [0090.479] GetProcessHeap () returned 0x13b0000 [0090.479] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6448 [0090.479] GetProcessHeap () returned 0x13b0000 [0090.479] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6448 | out: hHeap=0x13b0000) returned 1 [0090.479] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9bf0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0090.479] GetProcessHeap () returned 0x13b0000 [0090.479] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bc8 | out: hHeap=0x13b0000) returned 1 [0090.479] GetProcessHeap () returned 0x13b0000 [0090.480] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0090.480] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0090.481] GetProcessHeap () returned 0x13b0000 [0090.481] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bf0 | out: hHeap=0x13b0000) returned 1 [0090.481] GetProcessHeap () returned 0x13b0000 [0090.481] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0090.481] GetProcessHeap () returned 0x13b0000 [0090.481] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0090.481] GetProcessHeap () returned 0x13b0000 [0090.481] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13ceb90 [0090.481] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0090.482] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0090.482] CloseHandle (hObject=0x2dc) returned 1 [0090.482] GetProcessHeap () returned 0x13b0000 [0090.482] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0090.482] GetProcessHeap () returned 0x13b0000 [0090.482] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ceb90 | out: hHeap=0x13b0000) returned 1 [0090.482] Sleep (dwMilliseconds=0x3e8) [0091.934] GetProcessHeap () returned 0x13b0000 [0091.934] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9ba0 [0091.934] GetProcessHeap () returned 0x13b0000 [0091.934] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9bc8 [0091.934] GetProcessHeap () returned 0x13b0000 [0091.934] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9ad8 [0091.934] GetProcessHeap () returned 0x13b0000 [0091.934] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e66a8 [0091.935] GetProcessHeap () returned 0x13b0000 [0091.935] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e66a8 | out: hHeap=0x13b0000) returned 1 [0091.935] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9bc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.935] GetProcessHeap () returned 0x13b0000 [0091.935] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ad8 | out: hHeap=0x13b0000) returned 1 [0091.935] GetProcessHeap () returned 0x13b0000 [0091.935] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0091.935] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.935] GetProcessHeap () returned 0x13b0000 [0091.936] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bc8 | out: hHeap=0x13b0000) returned 1 [0091.936] GetProcessHeap () returned 0x13b0000 [0091.936] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0091.936] GetProcessHeap () returned 0x13b0000 [0091.936] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0091.936] GetProcessHeap () returned 0x13b0000 [0091.936] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cf290 [0091.936] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0091.936] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0091.936] CloseHandle (hObject=0x2dc) returned 1 [0091.936] GetProcessHeap () returned 0x13b0000 [0091.936] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0091.936] GetProcessHeap () returned 0x13b0000 [0091.937] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf290 | out: hHeap=0x13b0000) returned 1 [0091.937] Sleep (dwMilliseconds=0x3e8) [0093.348] GetProcessHeap () returned 0x13b0000 [0093.348] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9b28 [0093.348] GetProcessHeap () returned 0x13b0000 [0093.348] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9d80 [0093.348] GetProcessHeap () returned 0x13b0000 [0093.348] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9ad8 [0093.348] GetProcessHeap () returned 0x13b0000 [0093.348] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6610 [0093.348] GetProcessHeap () returned 0x13b0000 [0093.348] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6610 | out: hHeap=0x13b0000) returned 1 [0093.348] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9d80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0093.349] GetProcessHeap () returned 0x13b0000 [0093.349] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ad8 | out: hHeap=0x13b0000) returned 1 [0093.349] GetProcessHeap () returned 0x13b0000 [0093.349] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9b28 | out: hHeap=0x13b0000) returned 1 [0093.349] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.350] GetProcessHeap () returned 0x13b0000 [0093.350] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d80 | out: hHeap=0x13b0000) returned 1 [0093.350] GetProcessHeap () returned 0x13b0000 [0093.350] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0093.350] GetProcessHeap () returned 0x13b0000 [0093.350] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0093.350] GetProcessHeap () returned 0x13b0000 [0093.351] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cec10 [0093.351] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0093.351] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0093.351] CloseHandle (hObject=0x2dc) returned 1 [0093.351] GetProcessHeap () returned 0x13b0000 [0093.351] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0093.351] GetProcessHeap () returned 0x13b0000 [0093.351] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cec10 | out: hHeap=0x13b0000) returned 1 [0093.351] Sleep (dwMilliseconds=0x3e8) [0094.617] GetProcessHeap () returned 0x13b0000 [0094.617] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9ad8 [0094.617] GetProcessHeap () returned 0x13b0000 [0094.617] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9ba0 [0094.617] GetProcessHeap () returned 0x13b0000 [0094.618] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9d80 [0094.618] GetProcessHeap () returned 0x13b0000 [0094.618] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e71f0 [0094.618] GetProcessHeap () returned 0x13b0000 [0094.618] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e71f0 | out: hHeap=0x13b0000) returned 1 [0094.618] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9ba0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.618] GetProcessHeap () returned 0x13b0000 [0094.618] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d80 | out: hHeap=0x13b0000) returned 1 [0094.618] GetProcessHeap () returned 0x13b0000 [0094.618] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ad8 | out: hHeap=0x13b0000) returned 1 [0094.618] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.619] GetProcessHeap () returned 0x13b0000 [0094.619] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0094.619] GetProcessHeap () returned 0x13b0000 [0094.619] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0094.619] GetProcessHeap () returned 0x13b0000 [0094.619] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0094.619] GetProcessHeap () returned 0x13b0000 [0094.619] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cf310 [0094.619] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0094.619] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0094.619] CloseHandle (hObject=0x2dc) returned 1 [0094.620] GetProcessHeap () returned 0x13b0000 [0094.620] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0094.620] GetProcessHeap () returned 0x13b0000 [0094.620] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf310 | out: hHeap=0x13b0000) returned 1 [0094.620] Sleep (dwMilliseconds=0x3e8) [0096.269] GetProcessHeap () returned 0x13b0000 [0096.269] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9b28 [0096.270] GetProcessHeap () returned 0x13b0000 [0096.270] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9c18 [0096.270] GetProcessHeap () returned 0x13b0000 [0096.270] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9c40 [0096.270] GetProcessHeap () returned 0x13b0000 [0096.270] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6d30 [0096.270] GetProcessHeap () returned 0x13b0000 [0096.270] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6d30 | out: hHeap=0x13b0000) returned 1 [0096.270] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9c18, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0096.270] GetProcessHeap () returned 0x13b0000 [0096.270] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c40 | out: hHeap=0x13b0000) returned 1 [0096.270] GetProcessHeap () returned 0x13b0000 [0096.270] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9b28 | out: hHeap=0x13b0000) returned 1 [0096.270] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0096.271] GetProcessHeap () returned 0x13b0000 [0096.271] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c18 | out: hHeap=0x13b0000) returned 1 [0096.271] GetProcessHeap () returned 0x13b0000 [0096.272] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0096.272] GetProcessHeap () returned 0x13b0000 [0096.272] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0096.272] GetProcessHeap () returned 0x13b0000 [0096.272] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cf090 [0096.272] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0096.272] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0096.272] CloseHandle (hObject=0x2dc) returned 1 [0096.272] GetProcessHeap () returned 0x13b0000 [0096.272] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0096.273] GetProcessHeap () returned 0x13b0000 [0096.273] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf090 | out: hHeap=0x13b0000) returned 1 [0096.273] Sleep (dwMilliseconds=0x3e8) [0097.459] GetProcessHeap () returned 0x13b0000 [0097.459] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9ad8 [0097.459] GetProcessHeap () returned 0x13b0000 [0097.459] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9ba0 [0097.459] GetProcessHeap () returned 0x13b0000 [0097.459] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9cb8 [0097.459] GetProcessHeap () returned 0x13b0000 [0097.459] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e69a0 [0097.459] GetProcessHeap () returned 0x13b0000 [0097.459] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e69a0 | out: hHeap=0x13b0000) returned 1 [0097.460] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9ba0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0097.460] GetProcessHeap () returned 0x13b0000 [0097.460] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9cb8 | out: hHeap=0x13b0000) returned 1 [0097.460] GetProcessHeap () returned 0x13b0000 [0097.460] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ad8 | out: hHeap=0x13b0000) returned 1 [0097.460] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0097.461] GetProcessHeap () returned 0x13b0000 [0097.461] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0097.461] GetProcessHeap () returned 0x13b0000 [0097.461] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0097.461] GetProcessHeap () returned 0x13b0000 [0097.461] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0097.461] GetProcessHeap () returned 0x13b0000 [0097.461] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cea10 [0097.461] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0097.461] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0097.461] CloseHandle (hObject=0x2dc) returned 1 [0097.461] GetProcessHeap () returned 0x13b0000 [0097.462] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0097.462] GetProcessHeap () returned 0x13b0000 [0097.462] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cea10 | out: hHeap=0x13b0000) returned 1 [0097.462] Sleep (dwMilliseconds=0x3e8) [0099.153] GetProcessHeap () returned 0x13b0000 [0099.153] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9b50 [0099.153] GetProcessHeap () returned 0x13b0000 [0099.153] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9ad8 [0099.154] GetProcessHeap () returned 0x13b0000 [0099.154] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9c90 [0099.154] GetProcessHeap () returned 0x13b0000 [0099.154] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6e60 [0099.154] GetProcessHeap () returned 0x13b0000 [0099.154] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6e60 | out: hHeap=0x13b0000) returned 1 [0099.154] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9ad8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0099.154] GetProcessHeap () returned 0x13b0000 [0099.154] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c90 | out: hHeap=0x13b0000) returned 1 [0099.154] GetProcessHeap () returned 0x13b0000 [0099.154] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9b50 | out: hHeap=0x13b0000) returned 1 [0099.154] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0099.157] GetProcessHeap () returned 0x13b0000 [0099.157] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ad8 | out: hHeap=0x13b0000) returned 1 [0099.157] GetProcessHeap () returned 0x13b0000 [0099.157] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0099.157] GetProcessHeap () returned 0x13b0000 [0099.157] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0099.157] GetProcessHeap () returned 0x13b0000 [0099.157] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cef10 [0099.157] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0099.158] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0099.158] CloseHandle (hObject=0x2dc) returned 1 [0099.158] GetProcessHeap () returned 0x13b0000 [0099.158] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0099.158] GetProcessHeap () returned 0x13b0000 [0099.158] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cef10 | out: hHeap=0x13b0000) returned 1 [0099.158] Sleep (dwMilliseconds=0x3e8) [0100.505] GetProcessHeap () returned 0x13b0000 [0100.505] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9b50 [0100.505] GetProcessHeap () returned 0x13b0000 [0100.505] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9ba0 [0100.505] GetProcessHeap () returned 0x13b0000 [0100.505] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9c90 [0100.505] GetProcessHeap () returned 0x13b0000 [0100.505] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e70c0 [0100.505] GetProcessHeap () returned 0x13b0000 [0100.506] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e70c0 | out: hHeap=0x13b0000) returned 1 [0100.506] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9ba0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.506] GetProcessHeap () returned 0x13b0000 [0100.506] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c90 | out: hHeap=0x13b0000) returned 1 [0100.506] GetProcessHeap () returned 0x13b0000 [0100.506] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9b50 | out: hHeap=0x13b0000) returned 1 [0100.506] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.506] GetProcessHeap () returned 0x13b0000 [0100.506] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0100.506] GetProcessHeap () returned 0x13b0000 [0100.506] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0100.507] GetProcessHeap () returned 0x13b0000 [0100.507] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0100.507] GetProcessHeap () returned 0x13b0000 [0100.507] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cef90 [0100.507] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0100.507] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0100.507] CloseHandle (hObject=0x2dc) returned 1 [0100.507] GetProcessHeap () returned 0x13b0000 [0100.507] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0100.507] GetProcessHeap () returned 0x13b0000 [0100.507] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cef90 | out: hHeap=0x13b0000) returned 1 [0100.507] Sleep (dwMilliseconds=0x3e8) [0101.774] GetProcessHeap () returned 0x13b0000 [0101.774] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9b50 [0101.774] GetProcessHeap () returned 0x13b0000 [0101.774] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9c68 [0101.775] GetProcessHeap () returned 0x13b0000 [0101.775] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9d80 [0101.775] GetProcessHeap () returned 0x13b0000 [0101.775] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e66a8 [0101.775] GetProcessHeap () returned 0x13b0000 [0101.775] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e66a8 | out: hHeap=0x13b0000) returned 1 [0101.775] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9c68, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.775] GetProcessHeap () returned 0x13b0000 [0101.775] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d80 | out: hHeap=0x13b0000) returned 1 [0101.775] GetProcessHeap () returned 0x13b0000 [0101.775] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9b50 | out: hHeap=0x13b0000) returned 1 [0101.775] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.776] GetProcessHeap () returned 0x13b0000 [0101.776] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c68 | out: hHeap=0x13b0000) returned 1 [0101.776] GetProcessHeap () returned 0x13b0000 [0101.777] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0101.777] GetProcessHeap () returned 0x13b0000 [0101.777] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0101.777] GetProcessHeap () returned 0x13b0000 [0101.777] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13ce890 [0101.777] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0101.777] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0101.778] CloseHandle (hObject=0x2dc) returned 1 [0101.778] GetProcessHeap () returned 0x13b0000 [0101.778] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0101.778] GetProcessHeap () returned 0x13b0000 [0101.778] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ce890 | out: hHeap=0x13b0000) returned 1 [0101.778] Sleep (dwMilliseconds=0x3e8) [0104.832] GetProcessHeap () returned 0x13b0000 [0104.832] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9c90 [0104.833] GetProcessHeap () returned 0x13b0000 [0104.833] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9d08 [0104.833] GetProcessHeap () returned 0x13b0000 [0104.833] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9d30 [0104.833] GetProcessHeap () returned 0x13b0000 [0104.833] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6dc8 [0104.833] GetProcessHeap () returned 0x13b0000 [0104.833] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6dc8 | out: hHeap=0x13b0000) returned 1 [0104.833] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9d08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0104.834] GetProcessHeap () returned 0x13b0000 [0104.834] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d30 | out: hHeap=0x13b0000) returned 1 [0104.835] GetProcessHeap () returned 0x13b0000 [0104.835] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c90 | out: hHeap=0x13b0000) returned 1 [0104.835] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0104.837] GetProcessHeap () returned 0x13b0000 [0104.837] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d08 | out: hHeap=0x13b0000) returned 1 [0104.837] GetProcessHeap () returned 0x13b0000 [0104.837] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13bdb28 [0104.837] GetProcessHeap () returned 0x13b0000 [0104.838] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13be278 [0104.838] GetProcessHeap () returned 0x13b0000 [0104.838] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13be278, Size=0x72) returned 0x13ced90 [0104.838] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2dc [0104.840] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0104.840] CloseHandle (hObject=0x2dc) returned 1 [0104.841] GetProcessHeap () returned 0x13b0000 [0104.841] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdb28 | out: hHeap=0x13b0000) returned 1 [0104.841] GetProcessHeap () returned 0x13b0000 [0104.841] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ced90 | out: hHeap=0x13b0000) returned 1 [0104.842] Sleep (dwMilliseconds=0x3e8) [0106.431] GetProcessHeap () returned 0x13b0000 [0106.431] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9bf0 [0106.432] GetProcessHeap () returned 0x13b0000 [0106.432] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9bc8 [0106.432] GetProcessHeap () returned 0x13b0000 [0106.432] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9ba0 [0106.432] GetProcessHeap () returned 0x13b0000 [0106.432] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6870 [0106.432] GetProcessHeap () returned 0x13b0000 [0106.432] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6870 | out: hHeap=0x13b0000) returned 1 [0106.432] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9bc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0106.432] GetProcessHeap () returned 0x13b0000 [0106.432] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0106.432] GetProcessHeap () returned 0x13b0000 [0106.432] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bf0 | out: hHeap=0x13b0000) returned 1 [0106.432] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0106.433] GetProcessHeap () returned 0x13b0000 [0106.433] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bc8 | out: hHeap=0x13b0000) returned 1 [0106.433] GetProcessHeap () returned 0x13b0000 [0106.433] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0106.433] GetProcessHeap () returned 0x13b0000 [0106.433] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0106.433] GetProcessHeap () returned 0x13b0000 [0106.433] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13ceb90 [0106.433] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2e0 [0106.434] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0106.434] CloseHandle (hObject=0x2e0) returned 1 [0106.434] GetProcessHeap () returned 0x13b0000 [0106.434] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0106.434] GetProcessHeap () returned 0x13b0000 [0106.434] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ceb90 | out: hHeap=0x13b0000) returned 1 [0106.434] Sleep (dwMilliseconds=0x3e8) [0108.490] GetProcessHeap () returned 0x13b0000 [0108.490] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9d58 [0108.490] GetProcessHeap () returned 0x13b0000 [0108.490] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9ce0 [0108.490] GetProcessHeap () returned 0x13b0000 [0108.490] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9d80 [0108.490] GetProcessHeap () returned 0x13b0000 [0108.490] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6e60 [0108.491] GetProcessHeap () returned 0x13b0000 [0108.491] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6e60 | out: hHeap=0x13b0000) returned 1 [0108.491] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9ce0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0108.491] GetProcessHeap () returned 0x13b0000 [0108.491] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d80 | out: hHeap=0x13b0000) returned 1 [0108.491] GetProcessHeap () returned 0x13b0000 [0108.491] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d58 | out: hHeap=0x13b0000) returned 1 [0108.491] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0108.492] GetProcessHeap () returned 0x13b0000 [0108.492] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ce0 | out: hHeap=0x13b0000) returned 1 [0108.492] GetProcessHeap () returned 0x13b0000 [0108.492] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0108.492] GetProcessHeap () returned 0x13b0000 [0108.492] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0108.492] GetProcessHeap () returned 0x13b0000 [0108.492] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13ceb10 [0108.492] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2e0 [0108.493] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0108.493] CloseHandle (hObject=0x2e0) returned 1 [0108.493] GetProcessHeap () returned 0x13b0000 [0108.493] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0108.493] GetProcessHeap () returned 0x13b0000 [0108.493] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ceb10 | out: hHeap=0x13b0000) returned 1 [0108.493] Sleep (dwMilliseconds=0x3e8) [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9ba0 [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9bf0 [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9d08 [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e64e0 [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e64e0 | out: hHeap=0x13b0000) returned 1 [0109.893] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9bf0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d08 | out: hHeap=0x13b0000) returned 1 [0109.893] GetProcessHeap () returned 0x13b0000 [0109.893] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0109.893] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0109.894] GetProcessHeap () returned 0x13b0000 [0109.894] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bf0 | out: hHeap=0x13b0000) returned 1 [0109.894] GetProcessHeap () returned 0x13b0000 [0109.894] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0109.894] GetProcessHeap () returned 0x13b0000 [0109.894] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0109.894] GetProcessHeap () returned 0x13b0000 [0109.894] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cec10 [0109.894] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2e0 [0109.895] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0109.895] CloseHandle (hObject=0x2e0) returned 1 [0109.895] GetProcessHeap () returned 0x13b0000 [0109.895] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0109.895] GetProcessHeap () returned 0x13b0000 [0109.895] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cec10 | out: hHeap=0x13b0000) returned 1 [0109.895] Sleep (dwMilliseconds=0x3e8) [0111.564] GetProcessHeap () returned 0x13b0000 [0111.564] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9d58 [0111.564] GetProcessHeap () returned 0x13b0000 [0111.564] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9bc8 [0111.564] GetProcessHeap () returned 0x13b0000 [0111.564] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9bf0 [0111.564] GetProcessHeap () returned 0x13b0000 [0111.564] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6908 [0111.564] GetProcessHeap () returned 0x13b0000 [0111.564] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6908 | out: hHeap=0x13b0000) returned 1 [0111.564] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9bc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0111.564] GetProcessHeap () returned 0x13b0000 [0111.564] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bf0 | out: hHeap=0x13b0000) returned 1 [0111.564] GetProcessHeap () returned 0x13b0000 [0111.565] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9d58 | out: hHeap=0x13b0000) returned 1 [0111.565] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0111.565] GetProcessHeap () returned 0x13b0000 [0111.565] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bc8 | out: hHeap=0x13b0000) returned 1 [0111.565] GetProcessHeap () returned 0x13b0000 [0111.565] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0111.565] GetProcessHeap () returned 0x13b0000 [0111.565] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0111.565] GetProcessHeap () returned 0x13b0000 [0111.565] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13ce890 [0111.566] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2e0 [0111.566] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0111.566] CloseHandle (hObject=0x2e0) returned 1 [0111.566] GetProcessHeap () returned 0x13b0000 [0111.566] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0111.566] GetProcessHeap () returned 0x13b0000 [0111.566] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ce890 | out: hHeap=0x13b0000) returned 1 [0111.566] Sleep (dwMilliseconds=0x3e8) [0113.042] GetProcessHeap () returned 0x13b0000 [0113.042] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13e9ba0 [0113.042] GetProcessHeap () returned 0x13b0000 [0113.042] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13e9c18 [0113.043] GetProcessHeap () returned 0x13b0000 [0113.043] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13e9bf0 [0113.043] GetProcessHeap () returned 0x13b0000 [0113.043] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6ad0 [0113.043] GetProcessHeap () returned 0x13b0000 [0113.043] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6ad0 | out: hHeap=0x13b0000) returned 1 [0113.043] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13e9c18, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0113.043] GetProcessHeap () returned 0x13b0000 [0113.043] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9bf0 | out: hHeap=0x13b0000) returned 1 [0113.043] GetProcessHeap () returned 0x13b0000 [0113.043] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9ba0 | out: hHeap=0x13b0000) returned 1 [0113.043] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d4f9f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d4f9f0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0113.044] GetProcessHeap () returned 0x13b0000 [0113.044] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e9c18 | out: hHeap=0x13b0000) returned 1 [0113.044] GetProcessHeap () returned 0x13b0000 [0113.044] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be278 [0113.044] GetProcessHeap () returned 0x13b0000 [0113.044] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x3a) returned 0x13bdb28 [0113.044] GetProcessHeap () returned 0x13b0000 [0113.044] RtlReAllocateHeap (Heap=0x13b0000, Flags=0x0, Ptr=0x13bdb28, Size=0x72) returned 0x13cea90 [0113.044] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2e0 [0113.045] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0113.045] CloseHandle (hObject=0x2e0) returned 1 [0113.045] GetProcessHeap () returned 0x13b0000 [0113.045] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be278 | out: hHeap=0x13b0000) returned 1 [0113.045] GetProcessHeap () returned 0x13b0000 [0113.045] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cea90 | out: hHeap=0x13b0000) returned 1 [0113.045] Sleep (dwMilliseconds=0x3e8) Thread: id = 6 os_tid = 0x9e4 [0080.947] GetProcessHeap () returned 0x13b0000 [0080.947] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x440) returned 0x13d15b0 [0080.947] GetProcessHeap () returned 0x13b0000 [0080.947] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x434) returned 0x13d19f8 [0080.948] GetProcessHeap () returned 0x13b0000 [0080.948] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d19f8 | out: hHeap=0x13b0000) returned 1 [0080.948] GetProcessHeap () returned 0x13b0000 [0080.948] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d15b0 | out: hHeap=0x13b0000) returned 1 Thread: id = 7 os_tid = 0x1a4 [0080.951] GetProcessHeap () returned 0x13b0000 [0080.951] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x21a) returned 0x13d15b0 [0080.951] GetProcessHeap () returned 0x13b0000 [0080.951] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x28) returned 0x13c06a0 [0080.951] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x228 [0080.952] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x22c [0080.952] GetComputerNameW (in: lpBuffer=0x13d15c0, nSize=0x2f8feb4 | out: lpBuffer="NQDPDE", nSize=0x2f8feb4) returned 1 [0080.954] GetProcessHeap () returned 0x13b0000 [0080.954] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf490 [0080.954] GetProcessHeap () returned 0x13b0000 [0080.954] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x4000) returned 0x13d17d8 [0080.955] GetProcessHeap () returned 0x13b0000 [0080.955] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10000) returned 0x13d57e0 [0080.956] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2f8fe6c | out: lphEnum=0x2f8fe6c*=0x13b5000) returned 0x0 [0086.799] WNetEnumResourceW (in: hEnum=0x13b5000, lpcCount=0x2f8fe60, lpBuffer=0x13d17d8, lpBufferSize=0x2f8fe74 | out: lpcCount=0x2f8fe60, lpBuffer=0x13d17d8, lpBufferSize=0x2f8fe74) returned 0x103 [0086.800] WNetCloseEnum (hEnum=0x13b5000) returned 0x0 [0086.800] GetProcessHeap () returned 0x13b0000 [0086.800] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d17d8 | out: hHeap=0x13b0000) returned 1 [0086.800] GetProcessHeap () returned 0x13b0000 [0086.800] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d57e0 | out: hHeap=0x13b0000) returned 1 [0086.800] GetProcessHeap () returned 0x13b0000 [0086.800] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x4000) returned 0x13ec708 [0086.800] GetProcessHeap () returned 0x13b0000 [0086.800] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10000) returned 0x13d17d8 [0086.800] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2f8fe54 | out: lphEnum=0x2f8fe54*=0x13c0e68) returned 0x0 [0086.801] WNetEnumResourceW (in: hEnum=0x13c0e68, lpcCount=0x2f8fe48, lpBuffer=0x13ec708, lpBufferSize=0x2f8fe5c | out: lpcCount=0x2f8fe48, lpBuffer=0x13ec708, lpBufferSize=0x2f8fe5c) returned 0x103 [0086.801] WNetCloseEnum (hEnum=0x13c0e68) returned 0x0 [0086.801] GetProcessHeap () returned 0x13b0000 [0086.801] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13ec708 | out: hHeap=0x13b0000) returned 1 [0086.802] GetProcessHeap () returned 0x13b0000 [0086.802] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13d17d8 | out: hHeap=0x13b0000) returned 1 [0086.802] GetProcessHeap () returned 0x13b0000 [0086.802] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x4000) returned 0x13ec708 [0086.802] GetProcessHeap () returned 0x13b0000 [0086.802] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10000) returned 0x13d17d8 [0086.802] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2f8fe3c | out: lphEnum=0x2f8fe3c*=0x13b5000) returned 0x0 [0104.902] WNetEnumResourceW (in: hEnum=0x13b5000, lpcCount=0x2f8fe30, lpBuffer=0x13ec708, lpBufferSize=0x2f8fe44 | out: lpcCount=0x2f8fe30, lpBuffer=0x13ec708, lpBufferSize=0x2f8fe44) returned 0x0 [0104.911] GetProcessHeap () returned 0x13b0000 [0104.911] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x4000) returned 0x13e17e0 [0104.911] GetProcessHeap () returned 0x13b0000 [0104.911] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x10000) returned 0x13f0710 [0104.912] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x13ec708, lphEnum=0x2f8fdf4) Thread: id = 8 os_tid = 0xb04 [0082.280] GetLogicalDrives () returned 0x4 [0082.280] GetProcessHeap () returned 0x13b0000 [0082.280] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13be158 [0082.280] GetProcessHeap () returned 0x13b0000 [0082.280] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x28) returned 0x13c05b0 [0082.280] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x240 [0082.281] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x244 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf710 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf440 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf580 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e6a38 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e6a38 | out: hHeap=0x13b0000) returned 1 [0082.281] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf440, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf580 | out: hHeap=0x13b0000) returned 1 [0082.281] GetProcessHeap () returned 0x13b0000 [0082.281] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf710 | out: hHeap=0x13b0000) returned 1 [0082.282] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x308ff44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x308ff44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.282] GetProcessHeap () returned 0x13b0000 [0082.282] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf440 | out: hHeap=0x13b0000) returned 1 [0082.282] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0xffffffff) returned 0x0 [0082.282] CloseHandle (hObject=0x244) returned 1 [0082.282] CloseHandle (hObject=0x240) returned 1 [0082.283] GetProcessHeap () returned 0x13b0000 [0082.283] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13c05b0 | out: hHeap=0x13b0000) returned 1 [0082.283] GetProcessHeap () returned 0x13b0000 [0082.283] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13be158 | out: hHeap=0x13b0000) returned 1 Thread: id = 9 os_tid = 0xe0 [0082.276] GetLogicalDrives () returned 0x4 [0082.276] GetProcessHeap () returned 0x13b0000 [0082.276] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x20) returned 0x13cf760 [0082.276] GetProcessHeap () returned 0x13b0000 [0082.276] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x8, Size=0x1e) returned 0x13cf580 [0082.276] GetProcessHeap () returned 0x13b0000 [0082.276] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x1e) returned 0x13cf710 [0082.277] GetProcessHeap () returned 0x13b0000 [0082.277] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x90) returned 0x13e71f0 [0082.277] GetProcessHeap () returned 0x13b0000 [0082.277] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13e71f0 | out: hHeap=0x13b0000) returned 1 [0082.277] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13cf580, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.277] GetProcessHeap () returned 0x13b0000 [0082.277] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf710 | out: hHeap=0x13b0000) returned 1 [0082.277] GetProcessHeap () returned 0x13b0000 [0082.277] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf760 | out: hHeap=0x13b0000) returned 1 [0082.277] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x318fc3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x318fc3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.278] GetProcessHeap () returned 0x13b0000 [0082.278] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13cf580 | out: hHeap=0x13b0000) returned 1 [0082.278] GetProcessHeap () returned 0x13b0000 [0082.278] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x40) returned 0x13bdf60 [0082.278] GetProcessHeap () returned 0x13b0000 [0082.278] RtlAllocateHeap (HeapHandle=0x13b0000, Flags=0x0, Size=0x28) returned 0x13c0670 [0082.278] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x240 [0082.278] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x244 [0082.278] CloseHandle (hObject=0x244) returned 1 [0082.278] CloseHandle (hObject=0x240) returned 1 [0082.278] GetProcessHeap () returned 0x13b0000 [0082.279] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13c0670 | out: hHeap=0x13b0000) returned 1 [0082.279] GetProcessHeap () returned 0x13b0000 [0082.279] HeapFree (in: hHeap=0x13b0000, dwFlags=0x0, lpMem=0x13bdf60 | out: hHeap=0x13b0000) returned 1 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xcfdf000" os_pid = "0x42c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe94" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0xe88 [0095.639] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7bf9f0000 [0095.640] __set_app_type (_Type=0x1) [0095.640] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7bfa06d00) returned 0x0 [0095.640] __getmainargs (in: _Argc=0x7ff7bfa29200, _Argv=0x7ff7bfa29208, _Env=0x7ff7bfa29210, _DoWildCard=0, _StartInfo=0x7ff7bfa2921c | out: _Argc=0x7ff7bfa29200, _Argv=0x7ff7bfa29208, _Env=0x7ff7bfa29210) returned 0 [0095.641] _onexit (_Func=0x7ff7bfa07fd0) returned 0x7ff7bfa07fd0 [0095.641] _onexit (_Func=0x7ff7bfa07fe0) returned 0x7ff7bfa07fe0 [0095.641] _onexit (_Func=0x7ff7bfa07ff0) returned 0x7ff7bfa07ff0 [0095.642] _onexit (_Func=0x7ff7bfa08000) returned 0x7ff7bfa08000 [0095.643] _onexit (_Func=0x7ff7bfa08010) returned 0x7ff7bfa08010 [0095.643] _onexit (_Func=0x7ff7bfa08020) returned 0x7ff7bfa08020 [0095.644] GetCurrentThreadId () returned 0xe88 [0095.644] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe88) returned 0x70 [0095.645] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0095.645] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0095.645] SetThreadUILanguage (LangId=0x0) returned 0x409 [0096.556] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0096.556] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5180affc78 | out: phkResult=0x5180affc78*=0x0) returned 0x2 [0096.557] VirtualQuery (in: lpAddress=0x5180affc64, lpBuffer=0x5180affbe0, dwLength=0x30 | out: lpBuffer=0x5180affbe0*(BaseAddress=0x5180aff000, AllocationBase=0x5180a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0096.557] VirtualQuery (in: lpAddress=0x5180a00000, lpBuffer=0x5180affbe0, dwLength=0x30 | out: lpBuffer=0x5180affbe0*(BaseAddress=0x5180a00000, AllocationBase=0x5180a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0096.557] VirtualQuery (in: lpAddress=0x5180a01000, lpBuffer=0x5180affbe0, dwLength=0x30 | out: lpBuffer=0x5180affbe0*(BaseAddress=0x5180a01000, AllocationBase=0x5180a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0096.557] VirtualQuery (in: lpAddress=0x5180a04000, lpBuffer=0x5180affbe0, dwLength=0x30 | out: lpBuffer=0x5180affbe0*(BaseAddress=0x5180a04000, AllocationBase=0x5180a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0096.557] VirtualQuery (in: lpAddress=0x5180b00000, lpBuffer=0x5180affbe0, dwLength=0x30 | out: lpBuffer=0x5180affbe0*(BaseAddress=0x5180b00000, AllocationBase=0x5180b00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0096.558] GetConsoleOutputCP () returned 0x1b5 [0097.198] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7bfa2fbb0 | out: lpCPInfo=0x7ff7bfa2fbb0) returned 1 [0097.199] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7bfa18150, Add=1) returned 1 [0097.199] _get_osfhandle (_FileHandle=1) returned 0x25c [0097.200] GetConsoleMode (in: hConsoleHandle=0x25c, lpMode=0x7ff7bfa2fc04 | out: lpMode=0x7ff7bfa2fc04) returned 0 [0097.200] _get_osfhandle (_FileHandle=0) returned 0x258 [0097.200] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff7bfa2fc00 | out: lpMode=0x7ff7bfa2fc00) returned 0 [0097.200] _get_osfhandle (_FileHandle=1) returned 0x25c [0097.200] SetConsoleMode (hConsoleHandle=0x25c, dwMode=0x0) returned 0 [0097.200] _get_osfhandle (_FileHandle=1) returned 0x25c [0097.200] GetConsoleMode (in: hConsoleHandle=0x25c, lpMode=0x7ff7bfa2fc08 | out: lpMode=0x7ff7bfa2fc08) returned 0 [0097.200] _get_osfhandle (_FileHandle=0) returned 0x258 [0097.200] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff7bfa2fc0c | out: lpMode=0x7ff7bfa2fc0c) returned 0 [0097.201] GetEnvironmentStringsW () returned 0x17a43305a10* [0097.201] GetProcessHeap () returned 0x17a43300000 [0097.201] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xa7c) returned 0x17a433064a0 [0097.202] FreeEnvironmentStringsA (penv="A") returned 1 [0097.202] GetProcessHeap () returned 0x17a43300000 [0097.202] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x8) returned 0x17a43306f30 [0097.202] GetEnvironmentStringsW () returned 0x17a43305a10* [0097.202] GetProcessHeap () returned 0x17a43300000 [0097.202] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xa7c) returned 0x17a43306f50 [0097.202] FreeEnvironmentStringsA (penv="A") returned 1 [0097.203] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5180afeb28 | out: phkResult=0x5180afeb28*=0x7c) returned 0x0 [0097.203] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x0, lpData=0x5180afeb40*=0x4, lpcbData=0x5180afeb24*=0x1000) returned 0x2 [0097.203] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x1, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.203] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x0, lpData=0x5180afeb40*=0x1, lpcbData=0x5180afeb24*=0x1000) returned 0x2 [0097.203] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x0, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.204] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x40, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.204] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x40, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.204] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x0, lpData=0x5180afeb40*=0x40, lpcbData=0x5180afeb24*=0x1000) returned 0x2 [0097.204] RegCloseKey (hKey=0x7c) returned 0x0 [0097.204] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5180afeb28 | out: phkResult=0x5180afeb28*=0x7c) returned 0x0 [0097.204] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x0, lpData=0x5180afeb40*=0x40, lpcbData=0x5180afeb24*=0x1000) returned 0x2 [0097.204] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x1, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.205] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x0, lpData=0x5180afeb40*=0x1, lpcbData=0x5180afeb24*=0x1000) returned 0x2 [0097.205] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x0, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.205] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x9, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.205] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x4, lpData=0x5180afeb40*=0x9, lpcbData=0x5180afeb24*=0x4) returned 0x0 [0097.205] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5180afeb20, lpData=0x5180afeb40, lpcbData=0x5180afeb24*=0x1000 | out: lpType=0x5180afeb20*=0x0, lpData=0x5180afeb40*=0x9, lpcbData=0x5180afeb24*=0x1000) returned 0x2 [0097.205] RegCloseKey (hKey=0x7c) returned 0x0 [0097.205] time (in: timer=0x0 | out: timer=0x0) returned 0x5e0dc255 [0097.205] srand (_Seed=0x5e0dc255) [0097.205] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0097.206] malloc (_Size=0x4000) returned 0x17a435954f0 [0097.207] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0097.207] malloc (_Size=0xffce) returned 0x17a43400080 [0097.208] ??_V@YAXPEAX@Z () returned 0x17a43400080 [0097.209] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17a43400080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0097.210] malloc (_Size=0xffce) returned 0x17a43410060 [0097.211] ??_V@YAXPEAX@Z () returned 0x17a43410060 [0097.212] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17a43410060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0097.212] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0097.212] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0097.213] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0097.213] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0097.213] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0097.213] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0097.213] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0097.213] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0097.213] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0097.213] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0097.213] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0097.214] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0097.214] GetProcessHeap () returned 0x17a43300000 [0097.214] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a433064a0) returned 1 [0097.214] GetEnvironmentStringsW () returned 0x17a43305a10* [0097.214] GetProcessHeap () returned 0x17a43300000 [0097.214] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xa94) returned 0x17a43307a10 [0097.214] FreeEnvironmentStringsA (penv="A") returned 1 [0097.215] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0097.215] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0097.215] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0097.215] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0097.215] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0097.215] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0097.215] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0097.215] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0097.215] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0097.215] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0097.215] malloc (_Size=0xffce) returned 0x17a43420040 [0097.216] ??_V@YAXPEAX@Z () returned 0x17a43420040 [0097.217] GetProcessHeap () returned 0x17a43300000 [0097.217] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x40) returned 0x17a433084b0 [0097.218] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17a43420040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0097.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x17a43420040, lpFilePart=0x5180aff6a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x5180aff6a0*="Desktop") returned 0x17 [0097.219] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0097.222] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x5180aff3d0 | out: lpFindFileData=0x5180aff3d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x17a43308500 [0097.223] FindClose (in: hFindFile=0x17a43308500 | out: hFindFile=0x17a43308500) returned 1 [0097.223] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x5180aff3d0 | out: lpFindFileData=0x5180aff3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x17a43308500 [0097.223] FindClose (in: hFindFile=0x17a43308500 | out: hFindFile=0x17a43308500) returned 1 [0097.224] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x5180aff3d0 | out: lpFindFileData=0x5180aff3d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2558763b, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x2558763b, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x17a43308500 [0097.224] FindClose (in: hFindFile=0x17a43308500 | out: hFindFile=0x17a43308500) returned 1 [0097.224] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0097.225] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0097.225] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0097.225] GetProcessHeap () returned 0x17a43300000 [0097.225] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43307a10) returned 1 [0097.225] GetEnvironmentStringsW () returned 0x17a43300fc0* [0097.225] GetProcessHeap () returned 0x17a43300000 [0097.225] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xacc) returned 0x17a43308500 [0097.225] FreeEnvironmentStringsA (penv="=") returned 1 [0097.225] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17a43400080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0097.226] GetProcessHeap () returned 0x17a43300000 [0097.226] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a433084b0) returned 1 [0097.226] ??_V@YAXPEAX@Z () returned 0x1 [0097.226] ??_V@YAXPEAX@Z () returned 0x1 [0097.226] GetProcessHeap () returned 0x17a43300000 [0097.226] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x4016) returned 0x17a43308fe0 [0097.227] GetProcessHeap () returned 0x17a43300000 [0097.227] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43308fe0) returned 1 [0097.227] GetConsoleOutputCP () returned 0x1b5 [0097.634] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7bfa2fbb0 | out: lpCPInfo=0x7ff7bfa2fbb0) returned 1 [0097.634] GetUserDefaultLCID () returned 0x409 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7bfa2bb78, cchData=8 | out: lpLCData=":") returned 2 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x5180affa60, cchData=128 | out: lpLCData="0") returned 2 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x5180affa60, cchData=128 | out: lpLCData="0") returned 2 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x5180affa60, cchData=128 | out: lpLCData="1") returned 2 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7bfa2bb68, cchData=8 | out: lpLCData="/") returned 2 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7bfa2bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7bfa2bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7bfa2ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0097.637] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7bfa2ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0097.638] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7bfa2ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0097.638] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7bfa2b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0097.638] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7bfa2b980, cchData=32 | out: lpLCData="Sun") returned 4 [0097.638] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7bfa2bb58, cchData=8 | out: lpLCData=".") returned 2 [0097.638] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7bfa2bb40, cchData=8 | out: lpLCData=",") returned 2 [0097.638] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0097.644] GetProcessHeap () returned 0x17a43300000 [0097.644] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x0, Size=0x20c) returned 0x17a43306560 [0097.644] GetConsoleTitleW (in: lpConsoleTitle=0x17a43306560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0097.961] _get_osfhandle (_FileHandle=1) returned 0x25c [0097.961] GetFileType (hFile=0x25c) returned 0x3 [0097.963] ApiSetQueryApiSetPresence () returned 0x0 [0097.964] ResolveDelayLoadedAPI () returned 0x7ff92589d990 [0098.339] BrandingFormatString () returned 0x17a43301850 [0098.362] GetVersion () returned 0x3ad7000a [0098.362] _vsnwprintf (in: _Buffer=0x5180affbc0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x5180affb58 | out: _Buffer="10.0.15063") returned 10 [0098.363] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.364] GetFileType (hFile=0x25c) returned 0x3 [0098.364] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7bfa37f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0098.365] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7bfa37f60, nSize=0x2000, Arguments=0x5180affb60 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0098.366] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.366] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0098.366] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x5180affab8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180affab8*=0x26, lpOverlapped=0x0) returned 1 [0098.366] _vsnwprintf (in: _Buffer=0x7ff7bfa37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5180affb88 | out: _Buffer="\r\n") returned 2 [0098.366] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.366] GetFileType (hFile=0x25c) returned 0x3 [0098.367] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.367] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0098.367] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5180affb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180affb58*=0x2, lpOverlapped=0x0) returned 1 [0098.367] _vsnwprintf (in: _Buffer=0x7ff7bfa37f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x5180affb88 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0098.367] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.367] GetFileType (hFile=0x25c) returned 0x3 [0098.367] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.367] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0098.367] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x5180affb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180affb58*=0x34, lpOverlapped=0x0) returned 1 [0098.367] _vsnwprintf (in: _Buffer=0x7ff7bfa37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5180affb88 | out: _Buffer="\r\n") returned 2 [0098.367] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.368] GetFileType (hFile=0x25c) returned 0x3 [0098.368] _get_osfhandle (_FileHandle=1) returned 0x25c [0098.368] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0098.368] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5180affb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180affb58*=0x2, lpOverlapped=0x0) returned 1 [0098.368] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0098.369] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0098.369] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0098.369] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0098.369] ??_V@YAXPEAX@Z () returned 0x1 [0098.370] _get_osfhandle (_FileHandle=0) returned 0x258 [0098.370] GetFileType (hFile=0x258) returned 0x3 [0098.370] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0098.370] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x5180aff9c8 | out: TokenHandle=0x5180aff9c8*=0x0) returned 0xc000007c [0098.370] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x5180aff9c8 | out: TokenHandle=0x5180aff9c8*=0x94) returned 0x0 [0098.370] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x5180aff978, TokenInformationLength=0x4, ReturnLength=0x5180aff980 | out: TokenInformation=0x5180aff978, ReturnLength=0x5180aff980) returned 0x0 [0098.371] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x5180aff980, TokenInformationLength=0x4, ReturnLength=0x5180aff978 | out: TokenInformation=0x5180aff980, ReturnLength=0x5180aff978) returned 0x0 [0098.371] NtClose (Handle=0x94) returned 0x0 [0098.371] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x5180aff990, nSize=0x0, Arguments=0x5180aff998 | out: lpBuffer="茠䌰ź") returned 0xf [0098.371] GetProcessHeap () returned 0x17a43300000 [0098.371] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x218) returned 0x17a43306c30 [0099.086] GetConsoleTitleW (in: lpConsoleTitle=0x5180aff9e0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0099.636] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0099.637] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0100.278] GetProcessHeap () returned 0x17a43300000 [0100.278] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43306c30) returned 1 [0100.278] LocalFree (hMem=0x17a43308320) returned 0x0 [0100.282] _vsnwprintf (in: _Buffer=0x7ff7bfa37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5180aff808 | out: _Buffer="\r\n") returned 2 [0100.282] _get_osfhandle (_FileHandle=1) returned 0x25c [0100.282] GetFileType (hFile=0x25c) returned 0x3 [0100.282] _get_osfhandle (_FileHandle=1) returned 0x25c [0100.282] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0100.282] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5180aff7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180aff7d8*=0x2, lpOverlapped=0x0) returned 1 [0100.282] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0100.282] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17a43400080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0100.282] malloc (_Size=0x107ce) returned 0x17a43410060 [0100.284] _vsnwprintf (in: _Buffer=0x17a43410060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x5180aff818 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0100.284] _vsnwprintf (in: _Buffer=0x17a4341008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x5180aff818 | out: _Buffer=">") returned 1 [0100.284] _get_osfhandle (_FileHandle=1) returned 0x25c [0100.284] GetFileType (hFile=0x25c) returned 0x3 [0100.284] _get_osfhandle (_FileHandle=1) returned 0x25c [0100.284] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0100.284] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x5180aff808, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180aff808*=0x18, lpOverlapped=0x0) returned 1 [0100.285] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.285] GetFileType (hFile=0x258) returned 0x3 [0100.285] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.285] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.285] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0100.286] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.286] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.286] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0100.286] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.286] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.286] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0100.286] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.286] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.287] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0100.287] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.287] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.287] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0100.287] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.287] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.287] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0100.288] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.288] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.288] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0100.288] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.288] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.288] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0100.288] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.288] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.289] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0100.289] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.289] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.289] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0100.289] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.289] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.289] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0100.290] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.290] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.290] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0100.290] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.290] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.290] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0100.290] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.290] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.291] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0100.291] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.291] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.291] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0100.291] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.291] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.291] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0100.292] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.292] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.293] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0100.294] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.294] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.294] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0100.294] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.294] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.294] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0100.294] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.294] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.295] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0100.295] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.295] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.295] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0100.295] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.295] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.295] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0100.295] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.296] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.296] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0100.296] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.296] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.296] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0100.296] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.296] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.296] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0100.297] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.297] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.297] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0100.297] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.297] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.297] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0100.297] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.297] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.298] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0100.298] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.298] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.298] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0100.298] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.298] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.298] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0100.299] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.299] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.299] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0100.299] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.299] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.299] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0100.299] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.299] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.300] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0100.300] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.300] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.300] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0100.300] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.300] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.300] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0100.301] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.301] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.301] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0100.301] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.301] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.301] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0100.301] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.301] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.301] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0100.302] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.302] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.302] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0100.302] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.302] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.302] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0100.302] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.303] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.303] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0100.303] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.303] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.303] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0100.303] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.303] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.303] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0100.304] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.304] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.304] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0100.304] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.304] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.304] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0100.304] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.304] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.305] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0100.305] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.305] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.305] ReadFile (in: hFile=0x258, lpBuffer=0x7ff7bfa29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5180affb68, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesRead=0x5180affb68*=0x1, lpOverlapped=0x0) returned 1 [0100.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=1, lpWideCharStr=0x7ff7bfa33c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0100.308] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.308] GetFileType (hFile=0x258) returned 0x3 [0100.309] _get_osfhandle (_FileHandle=0) returned 0x258 [0100.309] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.309] _get_osfhandle (_FileHandle=1) returned 0x25c [0100.309] GetFileType (hFile=0x25c) returned 0x3 [0100.309] _get_osfhandle (_FileHandle=1) returned 0x25c [0100.309] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff7bfa29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0100.309] WriteFile (in: hFile=0x25c, lpBuffer=0x7ff7bfa29970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x5180affb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff7bfa29970*, lpNumberOfBytesWritten=0x5180affb08*=0x2f, lpOverlapped=0x0) returned 1 [0100.309] GetProcessHeap () returned 0x17a43300000 [0100.309] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x4012) returned 0x17a43308fe0 [0100.309] GetProcessHeap () returned 0x17a43300000 [0100.309] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43308fe0) returned 1 [0100.311] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0100.311] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0100.311] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0100.311] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0100.311] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0100.311] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0100.311] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0100.311] GetProcessHeap () returned 0x17a43300000 [0100.311] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xb0) returned 0x17a43308320 [0100.311] GetProcessHeap () returned 0x17a43300000 [0100.311] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x1c) returned 0x17a43306a80 [0100.313] GetProcessHeap () returned 0x17a43300000 [0100.313] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x64) returned 0x17a43301850 [0100.315] GetConsoleOutputCP () returned 0x1b5 [0100.830] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7bfa2fbb0 | out: lpCPInfo=0x7ff7bfa2fbb0) returned 1 [0100.830] SetThreadUILanguage (LangId=0x0) returned 0x409 [0101.387] GetConsoleTitleW (in: lpConsoleTitle=0x5180aff950, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0102.041] malloc (_Size=0xffce) returned 0x17a43420840 [0102.041] ??_V@YAXPEAX@Z () returned 0x17a43420840 [0102.150] malloc (_Size=0xffce) returned 0x17a43430820 [0102.150] ??_V@YAXPEAX@Z () returned 0x17a43430820 [0102.152] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0102.152] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0102.152] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0102.152] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0102.152] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0102.153] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0102.153] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0102.153] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0102.153] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0102.153] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0102.153] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0102.153] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0102.153] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0102.153] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0102.153] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0102.153] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0102.153] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0102.153] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0102.153] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0102.153] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0102.153] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0102.153] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0102.154] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0102.154] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0102.154] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0102.154] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0102.154] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0102.154] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0102.154] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0102.154] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0102.154] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0102.154] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0102.154] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0102.154] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0102.154] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0102.154] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0102.154] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0102.154] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0102.154] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0102.155] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0102.155] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0102.155] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0102.155] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0102.155] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0102.155] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0102.155] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0102.155] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0102.155] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0102.155] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0102.155] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0102.155] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0102.155] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0102.155] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0102.155] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0102.155] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0102.156] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0102.156] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0102.156] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0102.156] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0102.156] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0102.156] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0102.156] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0102.156] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0102.156] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0102.156] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0102.156] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0102.156] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0102.156] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0102.156] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0102.156] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0102.156] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0102.156] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0102.156] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0102.157] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0102.157] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0102.157] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0102.157] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0102.157] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0102.157] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0102.157] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0102.157] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0102.157] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0102.157] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0102.157] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0102.157] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0102.157] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0102.157] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0102.158] ??_V@YAXPEAX@Z () returned 0x1 [0102.158] GetProcessHeap () returned 0x17a43300000 [0102.158] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xffde) returned 0x17a43308fe0 [0102.160] GetProcessHeap () returned 0x17a43300000 [0102.160] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x70) returned 0x17a433083e0 [0102.160] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0102.160] malloc (_Size=0xffce) returned 0x17a43430820 [0102.160] ??_V@YAXPEAX@Z () returned 0x17a43430820 [0102.161] GetProcessHeap () returned 0x17a43300000 [0102.161] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x1ffac) returned 0x17a43318fd0 [0102.166] SetErrorMode (uMode=0x0) returned 0x0 [0102.166] SetErrorMode (uMode=0x1) returned 0x0 [0102.166] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x17a43318fe0, lpFilePart=0x5180aff1d0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x5180aff1d0*="Desktop") returned 0x17 [0102.166] SetErrorMode (uMode=0x0) returned 0x1 [0102.166] GetProcessHeap () returned 0x17a43300000 [0102.166] RtlReAllocateHeap (Heap=0x17a43300000, Flags=0x0, Ptr=0x17a43318fd0, Size=0x4c) returned 0x17a43318fd0 [0102.167] GetProcessHeap () returned 0x17a43300000 [0102.168] RtlSizeHeap (HeapHandle=0x17a43300000, Flags=0x0, MemoryPointer=0x17a43318fd0) returned 0x4c [0102.168] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0102.168] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.168] GetProcessHeap () returned 0x17a43300000 [0102.168] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x1bc) returned 0x17a43306c30 [0102.168] GetProcessHeap () returned 0x17a43300000 [0102.168] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x368) returned 0x17a43319030 [0102.812] GetProcessHeap () returned 0x17a43300000 [0102.812] RtlReAllocateHeap (Heap=0x17a43300000, Flags=0x0, Ptr=0x17a43319030, Size=0x1be) returned 0x17a43319030 [0102.812] GetProcessHeap () returned 0x17a43300000 [0102.812] RtlSizeHeap (HeapHandle=0x17a43300000, Flags=0x0, MemoryPointer=0x17a43319030) returned 0x1be [0102.813] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7bfa2bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.813] GetProcessHeap () returned 0x17a43300000 [0102.813] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xe8) returned 0x17a43306e00 [0102.817] GetProcessHeap () returned 0x17a43300000 [0102.817] RtlReAllocateHeap (Heap=0x17a43300000, Flags=0x0, Ptr=0x17a43306e00, Size=0x7e) returned 0x17a43306e00 [0102.817] GetProcessHeap () returned 0x17a43300000 [0102.818] RtlSizeHeap (HeapHandle=0x17a43300000, Flags=0x0, MemoryPointer=0x17a43306e00) returned 0x7e [0102.818] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.819] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x5180afef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5180afef40) returned 0xffffffffffffffff [0102.819] GetLastError () returned 0x2 [0102.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.820] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x5180afef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5180afef40) returned 0xffffffffffffffff [0102.830] GetLastError () returned 0x2 [0102.830] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.830] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x5180afef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5180afef40) returned 0x17a43306e90 [0102.831] GetProcessHeap () returned 0x17a43300000 [0102.831] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x0, Size=0x28) returned 0x17a43306ef0 [0102.831] FindClose (in: hFindFile=0x17a43306e90 | out: hFindFile=0x17a43306e90) returned 1 [0102.831] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x5180afef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5180afef40) returned 0xffffffffffffffff [0102.831] GetLastError () returned 0x2 [0102.832] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x5180afef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5180afef40) returned 0x17a43306e90 [0102.834] GetProcessHeap () returned 0x17a43300000 [0102.834] RtlReAllocateHeap (Heap=0x17a43300000, Flags=0x0, Ptr=0x17a43306ef0, Size=0x8) returned 0x17a43306ef0 [0102.834] FindClose (in: hFindFile=0x17a43306e90 | out: hFindFile=0x17a43306e90) returned 1 [0102.835] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.835] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.835] ??_V@YAXPEAX@Z () returned 0x1 [0102.835] GetConsoleTitleW (in: lpConsoleTitle=0x5180aff4c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0106.226] GetProcessHeap () returned 0x17a43300000 [0106.226] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x21c) returned 0x17a43319200 [0106.226] GetConsoleTitleW (in: lpConsoleTitle=0x17a43319210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0107.094] GetProcessHeap () returned 0x17a43300000 [0107.094] RtlReAllocateHeap (Heap=0x17a43300000, Flags=0x0, Ptr=0x17a43319200, Size=0xd8) returned 0x17a43319200 [0107.095] GetProcessHeap () returned 0x17a43300000 [0107.095] RtlSizeHeap (HeapHandle=0x17a43300000, Flags=0x0, MemoryPointer=0x17a43319200) returned 0xd8 [0107.095] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0108.252] GetProcessHeap () returned 0x17a43300000 [0108.252] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43319200) returned 1 [0108.252] InitializeProcThreadAttributeList (in: lpAttributeList=0x5180aff3e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x5180aff2d0 | out: lpAttributeList=0x5180aff3e0, lpSize=0x5180aff2d0) returned 1 [0108.252] UpdateProcThreadAttribute (in: lpAttributeList=0x5180aff3e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x5180aff2bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x5180aff3e0, lpPreviousValue=0x0) returned 1 [0108.253] GetStartupInfoW (in: lpStartupInfo=0x5180aff370 | out: lpStartupInfo=0x5180aff370*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x258, hStdOutput=0x25c, hStdError=0x25c)) [0108.253] GetProcessHeap () returned 0x17a43300000 [0108.253] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x20) returned 0x17a43306e90 [0108.253] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0108.253] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0108.253] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0108.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0108.255] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0108.255] GetProcessHeap () returned 0x17a43300000 [0108.255] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43306e90) returned 1 [0108.255] GetProcessHeap () returned 0x17a43300000 [0108.255] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0x12) returned 0x17a43306f10 [0108.256] _get_osfhandle (_FileHandle=1) returned 0x25c [0108.256] SetConsoleMode (hConsoleHandle=0x25c, dwMode=0x0) returned 0 [0108.256] _get_osfhandle (_FileHandle=0) returned 0x258 [0108.256] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0 [0108.256] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x5180aff300*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x5180aff2d8 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x5180aff2d8*(hProcess=0x98, hThread=0x94, dwProcessId=0xbec, dwThreadId=0xc30)) returned 1 [0108.693] CloseHandle (hObject=0x94) returned 1 [0108.694] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0108.694] GetProcessHeap () returned 0x17a43300000 [0108.694] RtlFreeHeap (HeapHandle=0x17a43300000, Flags=0x0, BaseAddress=0x17a43308500) returned 1 [0108.694] GetEnvironmentStringsW () returned 0x17a43308500* [0108.694] GetProcessHeap () returned 0x17a43300000 [0108.694] RtlAllocateHeap (HeapHandle=0x17a43300000, Flags=0x8, Size=0xacc) returned 0x17a43319520 [0108.694] FreeEnvironmentStringsA (penv="=") returned 1 [0108.694] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0108.695] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0108.695] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x5180afe7d8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5180afe7d8, ReturnLength=0x0) returned 0x0 [0108.695] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x848ed0000, lpBuffer=0x5180afe810, nSize=0x7a0, lpNumberOfBytesRead=0x5180afe7d0 | out: lpBuffer=0x5180afe810*, lpNumberOfBytesRead=0x5180afe7d0*=0x7a0) returned 1 [0108.697] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) Thread: id = 28 os_tid = 0xcf4 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xa2e1000" os_pid = "0x9e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x42c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0x824 Thread: id = 13 os_tid = 0xea0 Thread: id = 21 os_tid = 0x548 Thread: id = 26 os_tid = 0xcf8 Thread: id = 27 os_tid = 0xf10 Process: id = "5" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x728c3000" os_pid = "0xbec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x42c" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xc30 [0112.537] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7d9a30000 [0112.538] __set_app_type (_Type=0x1) [0112.538] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7d9a3a1c0) returned 0x0 [0112.538] __wgetmainargs (in: _Argc=0x7ff7d9a47668, _Argv=0x7ff7d9a47670, _Env=0x7ff7d9a47678, _DoWildCard=0, _StartInfo=0x7ff7d9a47684 | out: _Argc=0x7ff7d9a47668, _Argv=0x7ff7d9a47670, _Env=0x7ff7d9a47678) returned 0 [0112.540] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0112.541] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7d9a30000 [0112.541] _vsnwprintf (in: _Buffer=0x7ff7d9a49b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x8490f7a18 | out: _Buffer="netsh>") returned 6 [0112.542] GetProcessHeap () returned 0x1b03ec30000 [0112.542] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e9e0 [0112.542] GetProcessHeap () returned 0x1b03ec30000 [0112.542] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eb40 [0112.542] GetProcessHeap () returned 0x1b03ec30000 [0112.542] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e8c0 [0112.542] GetProcessHeap () returned 0x1b03ec30000 [0112.542] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e8e0 [0112.542] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e8a0 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3efa0 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3f020 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ef20 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e900 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ee80 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.543] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ec60 [0112.543] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ec40 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ed20 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eda0 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e960 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ef60 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eb60 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ee20 [0112.544] GetProcessHeap () returned 0x1b03ec30000 [0112.544] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eee0 [0112.545] GetProcessHeap () returned 0x1b03ec30000 [0112.545] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ec80 [0112.545] GetProcessHeap () returned 0x1b03ec30000 [0112.545] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ece0 [0112.545] GetProcessHeap () returned 0x1b03ec30000 [0112.545] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eca0 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eae0 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ea00 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ef40 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eb80 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eba0 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ec20 [0112.546] GetProcessHeap () returned 0x1b03ec30000 [0112.546] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ef80 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e9c0 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ed40 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ea40 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ed00 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ec00 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ea20 [0112.547] GetProcessHeap () returned 0x1b03ec30000 [0112.547] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eb00 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.548] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3edc0 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.548] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ed60 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.548] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eea0 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.548] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3efe0 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.548] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3f000 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.548] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ed80 [0112.548] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eec0 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ebc0 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3efc0 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e920 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e9a0 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eaa0 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.549] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ef00 [0112.549] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eb20 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ebe0 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e980 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3e940 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ea80 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ea60 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ee00 [0112.550] GetProcessHeap () returned 0x1b03ec30000 [0112.550] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3eac0 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ecc0 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ede0 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ee40 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ee60 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40440 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40360 [0112.551] GetProcessHeap () returned 0x1b03ec30000 [0112.551] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec400a0 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ffa0 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fee0 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40380 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ff20 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fde0 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40460 [0112.552] GetProcessHeap () returned 0x1b03ec30000 [0112.552] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40480 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40420 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40100 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fe80 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40280 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40060 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fe00 [0112.553] GetProcessHeap () returned 0x1b03ec30000 [0112.553] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec403a0 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40080 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ff80 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fd20 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ffc0 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec404a0 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40180 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.554] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fdc0 [0112.554] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40320 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec401a0 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fd40 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fda0 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40000 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec400c0 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.555] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40120 [0112.555] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec401c0 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ffe0 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec400e0 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40160 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ff00 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fd60 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.556] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec402a0 [0112.556] GetProcessHeap () returned 0x1b03ec30000 [0112.557] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ff40 [0112.557] GetProcessHeap () returned 0x1b03ec30000 [0112.557] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40200 [0112.557] GetProcessHeap () returned 0x1b03ec30000 [0112.557] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec403c0 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fe20 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec401e0 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fe40 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fe60 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fd80 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3ff60 [0112.558] GetProcessHeap () returned 0x1b03ec30000 [0112.558] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40020 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fea0 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec3fec0 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec403e0 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec402c0 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40400 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40220 [0112.559] GetProcessHeap () returned 0x1b03ec30000 [0112.559] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40040 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40140 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40240 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40260 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec402e0 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40300 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40340 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.560] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40c70 [0112.560] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40830 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40c90 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec409f0 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40b10 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40ad0 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40890 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.561] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40810 [0112.561] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40b30 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec409b0 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40cb0 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec408d0 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40bd0 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40a30 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.562] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40850 [0112.562] GetProcessHeap () returned 0x1b03ec30000 [0112.563] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40530 [0112.563] GetProcessHeap () returned 0x1b03ec30000 [0112.563] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40b50 [0112.563] GetProcessHeap () returned 0x1b03ec30000 [0112.563] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40a10 [0112.563] GetProcessHeap () returned 0x1b03ec30000 [0112.563] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40870 [0112.563] GetProcessHeap () returned 0x1b03ec30000 [0112.563] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40c10 [0112.563] GetProcessHeap () returned 0x1b03ec30000 [0112.563] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40a50 [0112.563] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec408f0 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40b70 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40690 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec407f0 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40c30 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec407d0 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.564] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40550 [0112.564] GetProcessHeap () returned 0x1b03ec30000 [0112.565] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40c50 [0112.565] GetProcessHeap () returned 0x1b03ec30000 [0112.565] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40570 [0112.565] GetProcessHeap () returned 0x1b03ec30000 [0112.565] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40930 [0112.565] GetProcessHeap () returned 0x1b03ec30000 [0112.565] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40a90 [0112.565] GetProcessHeap () returned 0x1b03ec30000 [0112.565] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40590 [0112.565] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40790 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40bb0 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40910 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec408b0 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40950 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40970 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40ab0 [0112.566] GetProcessHeap () returned 0x1b03ec30000 [0112.566] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40a70 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40af0 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec407b0 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40990 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40b90 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec409d0 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40bf0 [0112.567] GetProcessHeap () returned 0x1b03ec30000 [0112.567] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec405b0 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec405d0 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec405f0 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40610 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40630 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40650 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40670 [0112.568] GetProcessHeap () returned 0x1b03ec30000 [0112.568] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec406b0 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec406d0 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec406f0 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40710 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40730 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40750 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40770 [0112.569] GetProcessHeap () returned 0x1b03ec30000 [0112.569] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41360 [0112.570] GetProcessHeap () returned 0x1b03ec30000 [0112.570] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40fc0 [0112.570] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec413c0 [0112.982] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40ec0 [0112.982] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40e00 [0112.982] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41220 [0112.982] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41240 [0112.982] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40de0 [0112.982] GetProcessHeap () returned 0x1b03ec30000 [0112.982] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec411a0 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41260 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41000 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40fe0 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40d80 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41340 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec410c0 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40dc0 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41200 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.983] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec413e0 [0112.983] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40e60 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec412c0 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41400 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41300 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41040 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40e20 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec410e0 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41020 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec41180 [0112.984] GetProcessHeap () returned 0x1b03ec30000 [0112.984] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x10) returned 0x1b03ec40da0 [0112.985] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0112.985] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0112.985] GetProcessHeap () returned 0x1b03ec30000 [0112.985] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x28) returned 0x1b03ec3b840 [0112.985] GetProcessHeap () returned 0x1b03ec30000 [0112.985] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x2) returned 0x1b03ec3dec0 [0112.985] GetProcessHeap () returned 0x1b03ec30000 [0112.985] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x14) returned 0x1b03ec41060 [0112.985] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0112.985] GetProcessHeap () returned 0x1b03ec30000 [0112.986] RtlFreeHeap (HeapHandle=0x1b03ec30000, Flags=0x0, BaseAddress=0x0) returned 1 [0112.986] GetProcessHeap () returned 0x1b03ec30000 [0112.986] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x58) returned 0x1b03ec35ba0 [0112.986] GetProcessHeap () returned 0x1b03ec30000 [0112.986] RtlFreeHeap (HeapHandle=0x1b03ec30000, Flags=0x0, BaseAddress=0x0) returned 1 [0112.986] GetProcessHeap () returned 0x1b03ec30000 [0112.986] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0xb0) returned 0x1b03ec35040 [0112.986] GetProcessHeap () returned 0x1b03ec30000 [0112.986] RtlFreeHeap (HeapHandle=0x1b03ec30000, Flags=0x0, BaseAddress=0x1b03ec35ba0) returned 1 [0112.986] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ff92e3f0000 [0112.991] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x8490f79c8 | out: phkResult=0x8490f79c8*=0xb4) returned 0x0 [0112.991] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x8490f7a00, lpcbMaxValueNameLen=0x8490f7a10, lpcbMaxValueLen=0x8490f7a08, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x8490f7a00*=0x14, lpcbMaxValueNameLen=0x8490f7a10, lpcbMaxValueLen=0x8490f7a08, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.992] GetProcessHeap () returned 0x1b03ec30000 [0112.992] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x8, Size=0x16) returned 0x1b03ec414c0 [0112.992] GetProcessHeap () returned 0x1b03ec30000 [0112.992] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x8, Size=0x23) returned 0x1b03ec3b9f0 [0112.992] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x1b03ec414c0, lpcchValueName=0x8490f79c0, lpReserved=0x0, lpType=0x0, lpData=0x1b03ec3b9f0, lpcbData=0x8490f7a18 | out: lpValueName="2", lpcchValueName=0x8490f79c0, lpType=0x0, lpData=0x1b03ec3b9f0, lpcbData=0x8490f7a18) returned 0x0 [0112.993] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0112.993] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0112.993] GetProcessHeap () returned 0x1b03ec30000 [0112.993] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x50) returned 0x1b03ec416d0 [0112.993] GetProcessHeap () returned 0x1b03ec30000 [0112.993] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x4) returned 0x1b03ec3dfb0 [0112.993] GetProcessHeap () returned 0x1b03ec30000 [0112.993] RtlAllocateHeap (HeapHandle=0x1b03ec30000, Flags=0x0, Size=0x14) returned 0x1b03ec412a0 [0112.993] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0112.993] GetProcessHeap () returned 0x1b03ec30000 [0112.993] RtlFreeHeap (HeapHandle=0x1b03ec30000, Flags=0x0, BaseAddress=0x1b03ec3b840) returned 1 [0112.993] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) Thread: id = 32 os_tid = 0x9b0